ARP table clash with checkpoint and ASA firewal issue

We are migrating DMZ segments from a checkpoint to a ASA 5585 firewall that we had connected to the same segments as the Checkpoint except on different IP addresses then the checkpoint interfaces. The Checkpoint interfaces are the default gateway for the servers. When I implemented the NATs entries below we experienced an arp table clash with the checkpoint and ASA firewall on the local segments that caused a application outage. What was determined was that the checkpoint firewall was showing that all the IP addresses in particular on vlan130 segment was associating the MAC address of the ASA interface instead of the real sever MAC address. I need assistance understanding the reason why the Checkpoint was pointing the ARP entries for many different address on VLAN130 to the ASA firewall MAC?
nat (any,internet-outside) source static any any destination static isxh2007_Xlate_167.9.6.21 isxh2007_10.121.201.86 unidirectional description To match chkpt NAT rule #5
nat (VLAN130,internet-outside) source static ISX_EDI_Hosts isxh2008_Xlat_167.9.6.22 unidirectional
nat (any,internet-outside) source static Private-Addresses ISX_OUTBOUND_NAT_167.9.6.1 destination static external_167.9.x external_167.9.x unidirectional
nat (any,any) source static Mars-Internal-All Mars-Internal-All destination static Private-Addresses Private-Addresses
nat (internet-dmz,internet-outside) source static acs-vmww2419.mars-ad.net acs-vmww2419_xlate_167.9.6.23
nat (internet-dmz,internet-outside) source static acs_vmww2420 acs_vmww2420_xlate_167.9.6.24
nat (internet-dmz,internet-outside) source static pass_reset_internal_10.121.201.50 pass_reset_external_167.9.6.25
nat (internet-dmz,internet-outside) source static HE-Portal-poland_10.121.120.10 ext_HE-Portal-poland_167.9.6.26
nat (any,internet-outside) source dynamic any ISX_OUTBOUND_NAT_167.9.6.1
isxasa04/wwy-legacy# sho interface
Interface TenGigabitEthernet0/8.129 "core-inside", is down, line protocol is down
MAC address 442b.0330.aba2, MTU 1500
IP address 10.121.129.X, subnet mask 255.255.255.0
Traffic Statistics for "core-inside":
241633 packets input, 12094352 bytes
44788 packets output, 3032584 bytes
109732 packets dropped
Interface TenGigabitEthernet0/9.130 "VLAN130", is down, line protocol is down
MAC address 442b.0330.aba3, MTU 1500
IP address 10.121.130.X, subnet mask 255.255.255.0
Traffic Statistics for "VLAN130":
1264203 packets input, 136452168 bytes
326080 packets output, 69216516 bytes
794035 packets dropped
Interface TenGigabitEthernet0/9.136 "VLAN136", is down, line protocol is down
MAC address 442b.0330.aba3, MTU 1500
IP address 10.121.136.X, subnet mask 255.255.255.0
Traffic Statistics for "VLAN136":
374547 packets input, 23696109 bytes
51186 packets output, 3324895 bytes
173500 packets dropped
Interface GigabitEthernet0/1 "internet-outside", is down, line protocol is down
MAC address 442b.0330.ab9b, MTU 1500
IP address 167.9.6.X, subnet mask 255.255.255.0
Traffic Statistics for "internet-outside":
352158 packets input, 17245425 bytes
76888 packets output, 3872904 bytes
12255 packets dropped
Interface GigabitEthernet0/2 "internet-dmz", is down, line protocol is down
MAC address 442b.0330.ab9c, MTU 1500
IP address 10.121.201.X, subnet mask 255.255.255.0
Traffic Statistics for "internet-dmz":
237795 packets input, 12460108 bytes
40787 packets output, 2775684 bytes
27378 packets dropped
Interface GigabitEthernet0/4 "VLAN140", is down, line protocol is down
MAC address 442b.0330.ab9e, MTU 1500
IP address 10.121.140.X, subnet mask 255.255.255.0
Traffic Statistics for "VLAN140":
386931 packets input, 18807725 bytes
48936 packets output, 3319712 bytes
114417 packets dropped
We crosschecked MAC addresses and this is what we found:
Checkpoint ARP table:
10.121.130.101 44:2b:3:30:ab:a3 3285
ASA ARP table:
isxasa04/wwy-legacy# sh arp | i 10.121.130.101
VLAN130 10.121.130.101 001a.4b06.dd45 10525
Server real address provided by processing:
0x001A4B06DD45
When we saw that the Checkpoints had a different/wrong entry we shut down all the physical ports on the new ASAs (except for failover and management);
Kevin cleared the ARP table on the Checkpoints and problem was solved;
Later I saw this:
isxasa04# sh int | i MAC
MAC address 442b.0330.ab9a, MTU not set
MAC address 442b.0330.ab9b, MTU not set
MAC address 442b.0330.ab9c, MTU not set
MAC address 442b.0330.ab9d, MTU 1500
MAC address 442b.0330.ab9e, MTU not set
MAC address 442b.0330.ab9f, MTU not set
MAC address 442b.0330.aba0, MTU not set
MAC address 442b.0330.aba1, MTU not set
MAC address 442b.0330.ab98, MTU not set
MAC address 442b.0330.ab99, MTU not set
MAC address 442b.0330.aba2, MTU not set
MAC address 442b.0330.aba3, MTU not set

The Asa is proxy Arping those macs. Turn off proxy arp and put in static arp entries until you completely shut down the checkpoint.
Sent from Cisco Technical Support iPad App

Similar Messages

Table Relation with Payment and Invoice of Vendor

Hi all,
     I have one question about Table Relation with Payment and Invoice of Vendor.
     the scenario is.
     2 Purchase Order number : 100000001/100000002
     1 Invoice document number : 200000001 which include 2 Purchase Order.
     1 Payment document number : 300000001
     How should I found out table relation from Payment document number - Invoice document number - Purchase Order number. ?
      I try to link the following table, but it does not work.
      RBKP     *     Invoice Receipt
      RSEG     *     Invoice Receipt document line item
      BKPF     *     Accounting Document Header
BSEG     *     Accounting Document Segment
PAYR          Payment Medium File
BSIK          Accounting: Secondary Index for Vendors
BSAK          Accounting: Secondary Index for Vendors (Cleared Items)
BSIS          Accounting: Secondary Index for G/L Accounts (Open Items)
Does any one know about it ?
Regards
KY Chuang

Hi Venkatesh,
Thnx a lot for the reply. This has almost solved my problem, however there's one thing left. when I'm trying to take a print out after exporting the info into an excel sheet, the information really looks scattered, i.e., is there a way where we can go ahead and get the info in a rather unscattered manner.
I've tried to take a print directly without actually transferring the info into an excel sheet, then each of the vendor is printed in a separate page, which again they feel is a problem.
So, if you have an idea pls suggest.
Thnx again for the information.
regards
sandhya

What is the difference between READ TABLE ITAB WITH KEY and TABLE KEY

Hi Experts,
what is the difference between
READ TABLE <ITAB> WITH KEY <K1> = <C1>
<Kn> = <Cn> .
and
READ TABLE <ITAB> WITH TABLE KEY <K1> = <C1>
<Kn> = <Cn> .
Thanks
Akash.

Hi akashdeep,
Nice question. I also tried to find out, but no much success. My opinion is that for practical purposes there is no difference.
It may have difference in case of searching, especially sorted tables. (binary search or normal linear search).
Case1: If our table is sorted table with defined key fields, and we give WITH TABLE KEY, then faster binary search is used.
Case2 : If our table is sorted table with defined key fields, and we give WITH KEY, (and no field contained in the keys), then normal linear search is used.
regards,
amit m.

Table section with 3 header rows pagination issue

Hi experts.
I have a table section pagination issue. In my case the table section combines 3 header rows.
Down bellow the series of screenshots I hope they describe my example well (click on screenshots to enlarge).
1) The data context
2) Layout elements
Here is my issue (table header output at the end of the page but there is no data row):
As you can see on the first page there is no more place for a data row but the header still exists.
if I set keep with next flag on the pagination tab for all header rows the result will be:
Is it possible somehow to fix it?
I would like to have the header row output on the page only if a data row exists bellow the header, the footer should only output if a data row exists above.
Here is PDF output:
https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B4wQz1XhRuysMzhiN2EyYzM tMDdjZS00Yzc3LWIyNTgtODUzZWRhY2MwYjMx&hl=en_US
https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B4wQz1XhRuysNmYxNGFlOTk tZGQ2MS00MDQ3LTgyMWUtZTg4YmEwYWRmMWQ4&hl=en_US

The solutions is easy. You´d better create the corresponding DDIC objects hierarchy in the backend and then use the form to PRINT the prepared data ONLY. I mean:
In your backend:
in a row there is a dataset (table) and a optional dataset (table) == DDIC structure with two "fields" of type "table" = row A
use this "row" to create the "outer" table == DDIC table type with row A
Then you can just drag and drop this structure in your adobe form and will have do difficult with formatting.
Regards Otto

Shouldn't Apple recall and provide FREE replacement for MacBook Pro screens with ghosting and dead pixel issues?

Read the forum posts, Google the issue, watch the YouTube videos on the problems; they are everywhere. I purchased a 2012 Retina MacBook Pro and the screen is riddled with dead pixels, white ghosting throughout, and image retention issues, all from a company that promotes the quality of the product they sell. There's no way this issue facing so many consumers shouldn't result in Apple replacing these screens for FREE.
I purchased the high-end machine for photo and video editing. Photo editing is particularly difficult when I can't tell if I have dust, dirt or colour shifts in my images or if it's just the screen overlaying these issues. I've never had so many issues with any screen I've purchased, from my Panasonic Plasma TV to my cheap ACER laptop. Please Apple, quit ignoring this issue.

Be advised that this is a user to user forum where Apple employees do not participate. You may make your thoughts known here:
https://www.apple.com/feedback/
Ciao.

Checkpoint and ASA

Inside I have 2 networks: 10.10.x.x and a 10.199.x.x
My ASA interfaces was the following:
E0/0 Public IP
E0/1 10.199.1.2/24
E0/2 10.10.144.47/22
I put a checkpoint in front of the ASA and changed to the following:
Checkpoint Ext. 10.10.144.47/22
Checkpoint Int. 192.168.1.1/30
ASA E0/1 10.199.1.2/24
ASA E0/2 192.168.1.2/30
Now I am having trouble talking between the networks 10.199.x.x and 10.10.144. x
I have attached ASA config.
Thanks in advance on any help provided

Hi,
So if I am looking correct then the "insideNOV" interface leads to the Checkpoint which has the other LAN network behind it?
The interface ACL for the interface is not really clear to me as it contains a lot of "name" and "object-group" references which are not mentioned. It seems though that on multiple occasions you have referenced the NOV network as the destination. Should this not be the source network as that network is located behind that interface?
Also with regards to the routing you have only shared your Default Route in the configuration.
Do you have a route for the NOV network towards "insideNOV" ?
route insideNOV 10.10.144.0 255.255.252.0 192.168.1.1
Does the Checkpoint have the appropriate routing and other configurations to allow the traffic?
- Jouni

Pivot table sorting with month_id and average column in BI publisher temp

In my project we are using the Oracle BI analysis for creating reports in BI publisher.
At first we are creating the report in OBIEE answers then using it as data model in BI Pub.
My reporting table holds data like below:
Month_Name Year Month_Id Compensation Emp ID
JAN 2011 1000 50 1234
FEB 2011 1001 60 1235
We need to show the data in pivot format i.e period(concated month+year) in column and comepsation values as measure and emp id in rows.I also need to show percentage i.e sum(Compensation/no of selected of periods).
For average in OBIEE pivot i have create one calulated item. But I can't sort the data(for periods with the month_id) as its spillting the average column also.
How can i sort it? like JAN2011 FEB2011 MAR2011 in pivot
also in BI pub this calculated item not showing correct value.
Please help.

Hi,
You can achieve this requirement by sort order column based on the month number and year you can sort this criteria column.also by using time_key,if the time_key is in sequence.
mark if helpful/correct...
thanks,
prassu

How to export Tables along with Data and also Tables without data

Hi All,
I have a strange situation here. I have a 2 existing schema's under one database. Now the client wants to have 4 more schema's to incorporate the new branches of his company.
I want to know whether is it possible for me to run an expdp command by which i can have the data from the mentioned tables and only table structure of the remaining along with remaining database objects (procedure,functions,triggers,views,sequences etc).
Since there are some 32 Master tables, whose data i need to capture in db dump in order to run the batch under new schema and the remaining tables will be populated with data from the new branch employees hence the need is for table’s structure only.

Hi,
you should run two different import comand.
The first import with only metadata, just to recreate the structure.
With the second import you will import data only for the tables you need.
I think this is the simplier solution.
Acr

Single Table Inheritance with BDB and JPA

I am using Java based BDB (4.0) and using @Entity, @PrimaryKey, etc. tags to define my model. I am using @SecondaryKey to define relationships, e.g.
@Entity
public class User {
@PrimaryKey(sequence = "ids_seq")
private int id;
@SecondaryKey(relate = Relationship.MANY_TO_ONE, relatedEntity = Department.class, onRelatedEntityDelete = DeleteAction.CASCADE)
private Integer albumID;
@Entity
public class Department {
@PrimaryKey(sequence = "ids_seq")
private int id;
@SecondaryKey(relate = Relationship.ONE_TO_MANY, relatedEntity = User.class)
private Set<Integer> userIDs;
Now, I want to extend User and apply Single Table Inheritance, e.g.
@Entity
public class Employee extends User {
Can someone suggest how to do it with BDB. Thanks.

You may want to take a look at the "Entity Subclasses and Superclasses" section in the javadoc:
http://www.oracle.com/technology/documentation/berkeley-db/je/java/com/sleepycat/persist/model/Entity.html
Does this help?
--mark

[iPhone] UI Design pattern for table views with properties and children?

Hello,
I'm getting started with iPhone development and I have a question about the proper way to display a list that has both properties of the list itself as well as the ability to drill down into the members of the list. For example, my data is a Group (of people say). The Group itself can have properties - the name of the group, group email address, web page, etc. - and it obviously has members which also have properties - name, address, etc.
In my table view, I want to show the Group members and have accessory/disclosure buttons on each row to show the details of a person, but I also want to be able to edit the properties of the group - Group name, etc. What's the UI pattern for editing the properties of the table itself?
I thought about having a tabbar that toggles between the list and the properties of the list.
I also thought about having a parent table that lists the groups (so I could have more than one) and then have accessory buttons on each group row. The UI would then have to be that the user taps the row to drill down to the group members and taps the accessory button to edit the properties of the group. Is that "proper" - tap the bar or tap the accessory icon in a table row?
Thanks

I don't think I'd use a tab bar.
You could break the table up into 2 sections, section 0 being the properties, section 1 the list.
Make section 0 just say 'Properties', then when you tap that row you drill down to a properties table, slap an edit button in the navigation bar to go into edit mode.

GL Tables Partitioning with daily and monthly periods

This implementation(bank) has a requirement for 'daily periods' (01-Jan-2010 ...31-Dec-2010 ) and 'monthly periods' (Jan-2010 ...Dec-2010)
They are also using multiple sets of books, multi-org.
Please advise how to best partition GL tables to best serve those requirements.
Secondly,
Has anybody tried using an on-update trigger on GL_PERIOD_STATUSES to automatically create partition?
if CLOSING_STATUS changes to 'F' or 'O'
and period_name not in dba_tab_partitions
create partition
We plan to use GL_PERIOD_STATUSES because GL_PERIODS.period_name
still changes until the period_name becomes used.
Is there a much better way of doing this?

Thanks for the reply Sandeep.
Banks in our location are regulated by central bank and subject to daily report requirements, therefore the daily periods.
gl_balances and gl_je_lines are the two tables we are looking to partition.
estimated records for daily is around 500K to 1M.

Is there a better way to deal with Verizon and my DSL issues?

My family and I have been with Verizon for as long as we've had broadband internet. For the past 5 years or so the internet has been shaky at best. For the most part it works, but a coupe times a year it stops working all together or becomes VERY intermittent (and is usually working by the time I get finished sitting on hold and the test the technician runs shows no problems). Every time I have to wrestle with the "tech support" on the phone and listen to a recording tell me the same things over and over again that never fix my problems.
Every time my internet gets to this point, it requires a visit from a Verizon technician. Usually they go out into the neighborhood and find a length of cable and replace it. Usually that fixes my issues for a while, but I know it will happen again. It always happens again. It seems to me that the entire length of line that my internet runs through is old, and needs to be replaced. Instead of fixing the problem before it actually becomes a problem, Verizon continues to leave me and my family without service for periods of time.
Last week was the most recent time we dealt with this situation, which was fortunately short lived (Only all day Sunday, into Monday when the technician arrived). It's getting VERY tiring dealing with this situation over and over again, and it's getting offensive honestly. To hear the tech support person tell me that I will be charged $91 if the problem is found and is inside my house is ridiculous. I would understand if this was the first time this situation had occurred, or if I frequently reported non-issues. But no, I'm simply reporting the same issue that Verizon has failed to fix MANY times before.
Perhaps the most frustrating part of this, is that we've never been compensated for our lost service. Last year we lost service for an entire week. That's an entire week with no internet service at all. After we finally got it back, we spoke with the billing department and they told us that we would be credited for the week we lost service. At this point, we are yet to see any credit for the time we have been without the service we pay for. Perhaps we would have tried dealing with Verizon again to get our weeks credit, but attempting to contact someone in Verizon seems futile. Unless you're calling sales you end up sitting on hold for extended periods of time, only to be bounced from person to person until you get to someone that has no excuse not to pretend to help you.
Unless something changes, this is Verizon's last opportunity to keep our service. We have dealt with the loss of service followed by the insult of attempting to deal with Verizon's customer support for the last time. Next time it happens (and I'm sure there will be a next time) unless Verizon shows us that they are actually going to correct the problem, we will cancel our service and give our business to the competitor. This post is being written for a few reasons. I'm hoping that perhaps Verizon can give me a better way to contact someone locally when we have a problem (I would LOVE to speak with a regional manager, or even a local manager of some sort), or at least recognize that there is a problem that will end up costing them money.
Thank you,
A long time customer.

I've decided to give up the fight and go to another provider. I have work to do and having to wait at speeds slower than dial up is insane. At least with dial up I'd have some stability. I can't even run speedtest because it won't connect. At hotels, wi-fi, and hanging by blackberry the laptop works fine but to actually use dsl, nope. Multiple machines and multiple browsers - it's all the same worthless bandwidth.
If they won't give you fios then there is no reason to stay. They've been promising me the service is coming for the last 6 years. They could have run it here by now for the postage they've spent trying to get me to switch to it even though it isn't available. Waste, waste, waste ....

Importing WORD text files with formatting and Text Flow issues IDCS3

I am a designer who has used ID since it first came out, but have not been utilizing the larger document capabilities lately as I've been working in large format graphics (like really large, so if you have questions on that I can answer!). I am working on a new magazine and the copy is in WORD. I want to know the best way to bring in the text and keep the italic and bold formatting. The WORD docs have no style format done by the writers, so therefore changing the styles to my styles in the custom import section doesn't work. I tried making a character style sheet with no font chosen just "italics", but didn't work. I still was unable to make a paragraph style on top of it.
If anyone has a good methodology for bringing in WORD text and keeping it's attributes while applying ID style sheets please help!
Also with text flow, I have always had an issue with ID with not creating more pages to keep the flow going. In a test I just did I placed the text, but it did not create any new pages. I know there's a way to make that work, but spell it out for me like I'm a person losing their mind which seems to be the case!
Thank you in advance to the person who can give me advice!

What for settings do you have on the importoptions when bringing in Word? Keep formatting or loose formatting? And if loose formatting: is Keep local formatting on or off?

Trouble syncing photos with PSE7 (and the folder issue)

Here's a brief history on what I've done up to now:
I've had Photoshop Elements 7 installed for a while and I installed the PSE8 trial over top of it. I converted the catalog, and everything sync-wise was fine. After it exprired last night, however, I uninstalled it, and tried to revert back to PSE7. I added some photos to the catalog...
And there's where my troubles started. When I went back into iTunes to sync with PSE, it showed all of the albums I have previously made in PSE8, even though I uninstalled it. I managed to track down where the PSE8 copy of the catalog from where it was hiding, and deleted it.
Now, it doesn't even pick up any catalog anymore. Worse, when I sync my photos with PSE, it give me "iPod "" cannot be synced. The required folder cannot be found.". It does NOT give me this message when I sync with custom folders, but I strongly prefer to NOT do it that way and to do so with PSE7 instead.
I've tried uninstalling and reinstalling iTunes, restarted computer, nothing helps.
Does anyone know of a fix so that iTunes sees my catalog again? (Yes, I even deleted all instances of "iPod Photo Cache" from my computer too. Didn't help.)

Nevermind, seems I posted this in the wrong place.

CS5 trial issues with ram and content aware issues.

I run a vista 32 machine with 4 gigs. I have tried just about everything including running the machine in minmum and loading only windows and adobe CS5. I still get the error of "Could not fill because there is not enough memory (RAM)". I have tried playing with the performce settings and GL settings to give adobe as much memory as it needed but it is still not working.
I am working with a file that is 6.49mb which is the average of what my raw file convert to when I download them from my camera. Now the only way I can get it to work is seriously downgrade the file in size and then the content aware fill works great or decrease the area that is going to be filled.
So am I missing something or do I have to convert everything over to 64 bit and throw 8 gigs in this machine to get this to work with those tyoe of file sizes?
Thanks

Hi again everyone. I tried the original solution of turning off OpenGl support in preferances and that worked for me. Granted there are still some problems.
To recap:
I have an Intel Core i7 processor with 4GB RAM and Windows 7 Ultimate 32bit (didn't want to go down the 64bit route for compatability issues with other programs). Because Adobe do not support the Canon EOS 5D Mk II in CS3's camera RAW I upgraded to CS4 (that's were things began to become unstable). CS4 was flakey at best. Nice new feel (when it worked). Now I am no dummy when it comes to computers (I run my own IT company as well as photographic business - they kinda compliment each other). After loading CS5 (mainly for content aware feature and hoping it was a bit better than CS4 turned out to be - like most of you on this forum) the neat feature that Adobe had been raving about didn't work as advertised.
Back to where I am up to now. I will not turn this into a Mac vs PC debate since we have aldready had earlier, someone with a "brand new MacBook Pro" complaining of the same issue. I can state that, of all the systems I work on with Windows 7 (which is alot), the only one I am having major issues with is my own. And the only piece of software giving me grief (if you saw my two screens you would have trouble counting the apps on my system), is Photoshop CS5! After turning off OpenGL I can now stitch 12 or more RAW 5D MarkII photos with no problem, generating a file 938MB in size. The first time I did this I still had to original files open and it would not let me do any content aware modifications. Fair enough. I closed all the source files, flattened the layers to produce a single flat layer to work with and then tried content aware. "Not enough memory". I had to bring the file down in size to under 50MB to get it to work on any decent sized area. Now I don't want to have to go out and buy "Blow up" to renlarge my photos because Adobe can not get their memory management working! Lets be clear about this. This is not a Windows problem. Photoshop assigns its own memory, its own scratch disk and interfaces with the Graphics card. So if I assign 1.5GB of memory to Photoshop, 400GB as a scatch disk and have 1GB of video memory why does it still have issues with a 50MB file!!!! Piss poor programming!
Here are my issues. I was sold on CS5 due to a brilliant (if not misleading video) that showed "content aware" at work on Adobe's web site. There was no mention that I would need a super computer or 64bit operating system to work its magic. On purchasing the product as so many of you have discovered it does not work as promissed. In two days of posting to this site I have not seen one representative of Adobe making any comment as to even if they are working on this issue.
Please ADOBE, you big multinational software company, PLEASE make us feel better for having purchased CS5 and not let it be the big white lemon it seems to be.

ARP table clash with checkpoint and ASA firewal issue

Similar Messages

Maybe you are looking for