Great Circle Associates Firewalls
(April 1997)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Solstice Firewall-1 2.0 / Solaris 2.5 x86
From: Dennis Roberts <droberts @ excell . com>
Date: Wed, 30 Apr 1997 17:58:35 -0700
To: "'firewalls @ greatcircle . com'" <firewalls @ greatcircle . com>

So before I get on the phone with Sun again I am going to put my problem
out to the world:

Hardware:	Micron Pentium 133 with 32 MB RAM / 1.6 GIG drive / 2 Intel
PCI Pro 100B 100/10
Software:	Solaris 2.5 with recommend patch cluster installed (1/28/97
per read.me file)
		Soltice Firewall-1 2.0

1st problem: Whenever there is a probe to the network (via snmp,
ciscoworks, or SunNet Manager) I would get the following error in the
message file

"kdmctlmsg: bad M_CTL msg"

At this point routing would shutdown between the two NIC's and I would
have to reboot the box.  I called Sun and they sent me a post DU7
(Driver Update 7) NIC driver.  As the technician put it "Those cards are
flaky" - even though they are on the hardware compatibility list.  When
I used the new driver I would still get the error but routing would not
shutdown.

2nd problem: I get the following messages in the message file with the
new driver:

"fw_xlate_icmp: unsupported icmp type 13" & "fw_filter: reverse address
translation failed"

NOTE: At this point I am not using NAT (Network Address Translation)

BIG Problem:  The client decided to use NAT and when it is employed it
sorta works.  Example:

>From a Windows NT machine when I ping an Internet address it works but
comes back with an error message at the end of the ping:

"miscompare at offset 9."

Begin Screen Shot.
Reply from 192.135.191.1: bytes=32 time=10ms - MISCOMPARE at offset 9
TTL=251
End Screen Shot.

I am lost.  I put back on the old NIC driver to see if NAT worked then
but it didn't.  If there are any thoughts I would love to hear them
before I spend another $300 at Sun for tech. support.

TIA-Dennis

Indexed By Date Previous: Re: configuring automated email on a dialup link.
From: Tim Wood <tim_wood @ earthlink . net>
Next: Your website's "Findability" -- Search Engine Help
From: Planet_Ocean @ profitmaster . com
Indexed By Thread Previous: FW-1 securemote performance
From: Joe Presto <joepresto @ usa . net>
Next: Your website's "Findability" -- Search Engine Help
From: Planet_Ocean @ profitmaster . com

Google
 
Search Internet Search www.greatcircle.com