topic Re: Problem routing to firewall cluster in Operating System - HP-UX

Problem routing to firewall cluster

Jan Wunsche — Wed, 29 May 2002 06:20:23 GMT

We have a few HP-UX machines connected to a Firewall-1 (NG) firewall running StoneBeat FullCluster. The cluster is running in standby mode with only one node active. The cluster address is a shared IP-address with a multicast MAC-address. The firewall and HP-UX machines are connected through Cisco-switches with a Sun GigaSwift card on the firewall side.

When I set the default route on the HP-UX machine to the cluster address communication fails intermittently. It seems like it is up for about 3 minutes and then down for about 3 minutes. When I ping from a client and snoop the firewalls interface on its LAN I can see the echo requests being sent, but I see no replies during the down periods.

Setting a host route to the test client solves the problem for that client, even if the gateway is the cluster address of the firewall. Changing the default route to the firewall nodes physical IP-address also solves the problem (but then the cluster is of no use).

The problem appears for several HP-UX machines but does not seem to affect other machines (Sun Solaris, Dell Windows NT).

Any idea what is going on?

Re: Problem routing to firewall cluster

U.SivaKumar_2 — Wed, 29 May 2002 06:50:14 GMT

Hi,
In HP-UX , if you are adding a route with gateway x.x.x.x , it will try to send icmp echo
request packets ( ping ) to the gateway to see whether it is available viz. dead gateway detection. If it does not respond the route is
discarded.

You can try this on the HP-UX server.
#ndd -set /dev/ip ip_ire_gw_probe 0
and try your things again.

regards,
U.SivaKumar

Re: Problem routing to firewall cluster

U.SivaKumar_2 — Thu, 30 May 2002 05:01:27 GMT

hi,
For a permanent setting even after reboot put this lines in /etc/rc.config.d/nddconf
TRANSPORT_NAME[0]=ip
NDD_NAME[0]=ip_ire_gw_probe
NDD_VALUE[0]=0

regards,
U.SivaKumar

Re: Problem routing to firewall cluster

Jan Wunsche — Thu, 30 May 2002 06:07:24 GMT

That solved the problem. Because of a configuration problem the firewall didn't respond to pings to the cluster address and thus the HP stopped communicating. We are fixing the firewall problem but we'll also change the HPs configuration.

I still don't fully understand why it keeps coming back online for 3 minute periods. Since the problem is solved that isn't an important question.

Many thanks for your quick reply!