NGX R65 Release Notes - Check Point

ClusterXL
46. Peer or secure remote gateways may show error messages when working against an overloaded
gateway cluster in Load Sharing mode. This is due to IPsec packets with an old replay counter.
These error messages can be safely ignored.
47. Using Sticky Decision Function with VPN features will guarantee connection stickiness for
connections that pass through the cluster only, and not to connections originating from a
cluster member or to it.
48. When a Check Point VPN-1 NGX peer is connected directly to a Check Point cluster (i.e., the
peer and the cluster are located on the same VLAN and there is no Layer 3 (IP) routing device
between them), the following features are not supported:
• ISP Redundancy
• VPN link selection - Reply from same interface
This issue can be resolved either by placing a router between the VPN peer and the cluster, or
by disabling these features. (Neither feature is enabled by default.)
• To disable ISP redundancy, in SmartDashboard edit the gateway object > Topology > ISP
Redundancy, and remove the check mark from Support ISP Redundancy.
• To disable VPN link selection - Reply from the same interface, in SmartDashboard edit the
gateway object > VPN > Link Selection > Outgoing Route Selection, and do the following:
A. Under When initiating a tunnel, enable Operating system routing table,
B. and under When responding to remotely initiated tunnel, select Setup, and enable Use
outgoing traffic configuration.
49. When configuring a VTI cluster interface, it should be assigned a name identical to the name
of the member interface.
VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 10