Syslog traffic

[tavi0906]

Where should we find this setting “perform_cluster_hide_fold” ?  is this setting for global level or for individual cluster VIP interface level ?

We are seeing the syslog traffic being sourced from VIP and one of the physical IP.

If the syslog traffic sourced from Virtual IP, how do we verify that the syslog data is being sent by both Active and Standby Firewall ?

[G_W_Albrecht]

sk34180: Outgoing connections from cluster members are sent with cluster Virtual IP address instead ...

sk154272: Changing the value of "perform_cluster_hide_fold" field does not change the ClusterXL beha...

[tavi0906]

“perform_cluster_hide_fold” ?  is this setting for global level or for individual cluster VIP interface level ?

we are seeing the syslog traffic being sourced from VIP and one of the physical IP.

If the syslog traffic sourced from Virtual IP, how do we verify that the syslog data is being sent by both Active and Standby Firewall ?

[G_W_Albrecht]

Please read sk34180 to learn that this is configured on cluster level, in Cluster Object in Security Management Server database.

[tavi0906]

If the syslog traffic sourced from Virtual IP, how do we verify that the syslog data is being sent by both Active and Standby Firewall ?

[G_W_Albrecht]

What do you you want to know from StandBy member syslog ? Usually that member does nothing but sync some tables...

[Lesley]

Do couple incorrect passwords on stand-by member this will trigger syslog event if you do it wrong often enough.

Also I suspect hostname is included in the syslog data, so you will see syslog from 1 IP only but in the data itself you can see if it is member 1 or 2.

[PhoneBoy]

fw monitor from the standby member should show the standby member sending syslog (if it is doing so).