NGX R65 Release Notes - Check Point

ClusterXL
6. A cluster IP interface or a synchronization network interface cannot be defined as a
non-monitored (i.e., disconnected) interface.
7. Acceleration is not supported when using ClusterXL Load Sharing with Sticky Decision Function
(SDF). When SDF is enabled, acceleration is automatically turned off. To re-enable
acceleration, first make sure acceleration is enabled by running the cpconfig configuration tool.
Then disable SDF (in SmartDashboard, edit the Gateway Cluster object, select the ClusterXL
page, and click Advanced), and install the new Security Policy twice.
Installing the Security Policy twice is also required when moving from ClusterXL Load Sharing
with SDF to ClusterXL High Availability when acceleration is turned on.
8. When defining VLAN tags on an interface, cluster IP addresses can be defined only on the
VLAN interfaces (the tagged interfaces). Defining a cluster IP address on a physical interface
that has VLANs is not supported. The physical interface should be defined with the Network
Objective Monitored Private on ClusterXL clusters and as Private on third-party clusters.
9. When setting an interface whose current Network Objective is Sync to Non-Monitored Private,
and setting another interface's Network Objective to Sync and installing policy, the status of the
cluster members will change to Active Attention and Down. To avoid this issue, make this
configuration change in two phases.
1. Set the interface with the Network Objective of Sync to Monitored Private (instead of
Non-Monitored), and the other interface’s Network Objective to Sync and install policy.
2. Reconfigure the Monitored Private interface to Non-Monitored and install policy again.
10. When defining a Sync interface on a VLAN interface, it can only be defined on the lowest VLAN
tag on a physical interface.
11. Defining the lowest VLAN tag on a physical interface as disconnected (Non-Monitored Private)
is not supported.
12. Defining a Sync interface on a VLAN interface is not supported on Nokia clusters and on other
third party clusters.
13. A cluster object must contain two or more gateways. If configuring only one gateway, do not
configure a cluster.
ConnectControl
14. The Server Load balance method is not supported.
15. The Domain balance method is not supported for Logical Servers.
16. If a Logical server is configured to have an IP address that belongs to the external network of
the gateway, no Automatic Proxy ARP is configured on the gateway to the IP address of the
Logical server. As a result there is no communication to the Logical server from external hosts.
To resolve this issue, manually configure Proxy ARP using the file $FWDIR/conf/local.arp. See
"Automatic Proxy ARP" in the ClusterXL User Guide for local.arp file configuration instructions.
17. Logical Servers are not supported in conjunction with Security Servers.
18. When configuring Server Availability for ConnectControl (SmartDashboard > Policy menu >
Global Properties > ConnectControl), the value for the Server availability check interval must be a
multiple of 5 and no less than 15.
General
1. In certain cases, installing policy on a cluster member may cause its state to change and a
failover may subsequently occur. To prevent this situation, modify the firewall global parameter
fwha_freeze_state_machine_timeout. This parameter sets the number of seconds during policy
installation in which no state changes (including the "false" failover) will occur. Set this
parameter to the shortest period which eliminates the issue; the recommended value is 30
seconds.
VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 4