NGX R65 Release Notes - Check Point

ClusterXL
member than the client-to-server side. Asymmetric connections are only opened when using
VPN or static NAT. This is a temporary performance degradation that affects only a small
percentage of traffic.
9. When installing a new policy that uses Sticky Decision Function (configured in SmartDashboard
> Cluster Object > ClusterXL page > Advanced), and the old policy used the regular decision
function, some connections may be lost, especially connections to or from the cluster
members. New connections are unaffected.
10. After a failover, non-pivot members of a ClusterXL cluster in Unicast mode may report incorrect
load distribution information. For the correct load distribution, review the information reported
by the pivot member.
11. When using ClusterXL in Load Sharing mode and the Sticky Decision Function is enabled, the
failure of a module within 40 seconds of an IKE negotiation may cause a connectivity failure
with that peer for up to 40 seconds.
• When the failure involves a PIX gateway, communications may be interrupted for up to 40
seconds.
• When the failure involves an L2TP client, communications may be disconnected, as
keepalive packets are blocked during this period.
12. traceroute may fail if it passes through a Load Sharing cluster. To resolve this issue, on the
Cluster object, select ClusterXL > Advanced and in the Advanced Load Sharing Configuration
window you should either:
• select Use Sticky Decision Function, or
• change the selection for Use sharing method based on: to IPs.
Platform Specific — Nokia
13. Either Nokia VRRP or Nokia IP Clustering configuration must be used when creating a cluster
based on an IPSO platform. Using other OPSEC Certified third party clustering products (such
as OPSEC Certified external load balancers) to create a cluster based on IPSO platforms has
limited support. Contact Check Point Support and receive configuration instruction and a list of
associated limitations.
14. After configuring a gateway cluster on a Nokia platform via the Simple mode (wizard), be sure to
complete the cluster interface definition on the Topology page of the cluster object.
15. The feature Connectivity enhancements for multiple interfaces is not supported on Nokia IP
clustering in Forwarding mode.
16. NAT rules should not be applied to VRRP traffic. To prevent NAT rules from being applied to
VRRP traffic, define the following manual NAT rule and give it higher priority than other NAT
rules that relate to Cluster VIPs or to their networks:
Original Packet Translated Packet Install On
Source Destination Service Source Dest Service
Physical IP of VRRP IP: 224.0.0.18 Any Original Original Original relevant cluster
VRRP members
17. When configuring a Nokia IP Cluster, do not set the primary or secondary interfaces to Network
Objective Private. Check Point recommends setting a Nokia IP Cluster’s primary interface to
Network Objective Cluster, and its secondary interface to Network Objective Cluster or Sync.
18. The Get Topology operation supports up to 256 interfaces on Nokia platforms. To define more
than 256 interfaces, you need to do so manually.
VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 6