Dear Checkpoint Community,
I’m facing a problem and can’t move forward with it. Current setup is a ClusterXL Act-Act , Load-Sharing Multicast mode ; OS = R81.20.
On the firewall I’ve a Public IP translated to private IP ( normal destination nat ) using https. Having both nodes up the traffic distribution goes to first fw1 were it get’s nat-ed, leaves via the internal interface and send a SYN to server. But the respond goes to fw2 were there is no session for it and get’s dropped “first packet isn’t SYN “
I’ve already tried to change the tcp 3-way handshake synchronization mode from default value to “smart sync” – did not help. Changing in Global_prop Stateful inspection setting for tcp out of state drop – did not help, Doing zdebug + drop I'm see also an error like: coockie validation error message. Here I need to mention that IPS is turned off.
Last information, this setup did work correctly on r80.40 version with exact the same settings – problem started in version 81.10 and .20. If you have any suggestions how to proceed, please let me know. Is there a way to hold / stick the session to the gateway who first received the packet from external (internet ) ? One of my suspicions is that maybe the port nat pool which is divided between the two cluster members get exhausted.
Any hint appreciated.
