IP failover and firewall
Hello
and thanks for spending Your time reading my post!
I am trying to set up two mini-servers with IP failover. But to my big surprise it's almost as complicated as setting up heartbeat on two linux boxes. In the 10.6 server documentation I didn't find anything - the documentation for 10.3 helps... So much for my complaints
I have two problems:
The first - and really important one - is, that the failover does not work with the firewall running. What happens is, that the backup-server takes over the IP as expected (as ifconfig, the logfile and my mailbox show...), but one cannot reach the IP from the net. As soon as I shut down the firewall everything works fine. But I really don't want servers to run without firewall!
The second one is the - whats the right word - switch back, when the primary server is up and running again. The backupserver sees the running primary server but still tries to get its IP:
+mDNSResponder[38]: setsockopt - IPMULTICASTIF error 192.168.1.251 -1 errno 49 (Can't assign requested address)+
Has anyone a hint for me?
Thanks in advance,
Sven
Message was edited by: Sven Koesling (typos
Sorry, it took a long time, but I think I figured it out:
In Server-Admin You have to configure the options of the firewall - in german the button is called "Erweitert" (the last one) according to the fail-over IP address.
You have to allow the communication through the desired ports from Your network to the fail-over IP address. E.g. allow anything on port 3128 from 192.168.1-net to 192.168.1.5 where 192.168.1.5 is Your fail-over IP address.
Greetings
Sven
Similar Messages
-
Connection failover and transaction failover
Connection failover and transaction failover
I need to know more about a behavior in a RAC cluster. When a node goes down that is executing one of my transaction through JDBC , does the connection and transaction failover to a new node without me needing to restart tran or reconnect ?
Please provide some insight
ThanksTransactions are NOT automatically rolled back. The application must do this otherwise the session will get disconnected.
If you code TAF, all sessions will failover to the backup connection. You can specify that select statements are automatically re-executed after the failover. Insert/update/delete transactions must be explicitly rolled back and resubmitted by the application.
IF you are using an ORacle Connection pool, the connection pool will automatically cleanup connections to the failed instance, abort inflight transactions. The application will either retry or it will propagate the error to the end user.
See the whitepaper on the OTN RAC page (otn.oracle.com/rac) Workload Management with Oracle RAC for more information. -
Have deleted temp video, configured anti spam and firewall, and one specific video keeps giving me an error. Just tried downloading a previous episode of the show and it worked just fine. Always sunny in philly "Charlie rules the world" anyone else??
Have deleted temp video, configured anti spam and firewall, and one specific video keeps giving me an error. Just tried downloading a previous episode of the show and it worked just fine. Always sunny in philly "Charlie rules the world" anyone else??
-
Can't update iOS 8 on my iPhone5 through iTunes on Windows 8 (error 3004, 3194). Updated host file, opened port 80, 443; turned off security system and firewall, etc. But nothing works. How to solve this problem?
Hi the_mad_movies,
It seems like this article will be the best option for addressing this issue:
Error 3194, Error 17, or "This device isn't eligible for the requested build"
http://support.apple.com/kb/ts4451
Thanks for coming to the Apple Support Communities!
Cheers,
Braden -
Setting up gateway and firewall in OS X Server 10.3?
Hi all,
I have a G4 tower with two working ethernet cards in it that I would like to configure as a gateway and firewall. It has OS X Server 10.3 on it. I have easily found the firewall configuration in the Server Admin intrerface, but I can find nothing about configuring the server to act as a gateway. The only information I have found that is pertinent is related to the Gateway Setup Assistant that comes with OS X Server 10.4, which doesn't exaclty help me. Does anyone have any documentation on configuring OS X Server 10.3 to be a gateway? Thanks.Actually, I may have marked this as answered too quickly...
So I followed the guide at the back of the getting started manual, and set everything up as follows:
- PCI ethernet card is set up as the connection to the outside world. It is plugged into a switch which connects to a wall jack. In Network under System Preferences, it is set up as the first internet conection to try. It has a static IP address, and is set up to use the organization's DNS servers. It is NOT plugged into the upstream port, but is instead in port #9. The light on the router is on.
- Built-in wireless is set up to be the internal connection. It is plugged into the upstream slot on anouther switch. It has a static IP address, and is set up to use the organization's DNS servers. The light on the router is on, so it appears there is a connection.
- A different computer is plugged into the second switch, which a static IP address and to use the organization's DNS servers.
So basically, unlike in the scenario in the manual, I am not using the OS X Server for DNS, DHCP or NAT services. That should, if anything, simplify it.
The firewall service is started, and is set to allow all traffic in and out, no problems. Nice and simple to start.
The server has an okay connection to the outside world via the PCI ethernet card. I can ping other machines and load web pages. I cannot, however, access the machine connected to the router which is connected to the built-in ethernet. Likewise, that machine has no access to either the OS X Server or the outsideworld.
How does OS X Server decide which ethernet card is to be connected to the outside world, and which is for the internal firewall? Is the confusion possible because I'm connected to two routers? -
Thrree different times I attempted to download the new OS to my wife's iPad. each time it would proceed to a point somewhere around 80 minutes remaining (started with 3+ hours remaining and downloaded about 4mb per minute). I have a 1mbDSL line that routinely tests out at around .85mb per min. I have tried all the "fixes" I found on the site including isolating allother USB interfaced hardware, rebooting both machines (PC and iPad), shutting off AV and firewall and still it fails at about the same point - giving error 3259.
An attempt to find other info or any way to comminicate directly with Apple re this was not successful.
Any ideas?
My next idea is to take the entire PC to my son's where there is a faster internet connection but that is a lot of trouble and you shouldn;t have to do that. with other large file updates I have done on other software, if it fails or times out you are able to resume where it left off and eventually get it done.An alternative is to try downloading the update via a browser : https://discussions.apple.com/message/16703914#16703914
You could also do that via, for example, a friend's computer and then copy it to your own computer for the actual update. -
when installing third party software, how do I temporarily turn off the factory installed virus sw and firewall? Is it necessary on a Mac to do so? I come from the Windows world and am still in the learning curve on the Mac.
Correct. I have not installed ANY other software for anti-virus, etc. I want to install a Synch app for my HTC phone to sych with MS Outlook 2011 installed on my Mac. HTC will not synch with it otherwise. That was really the basis for my question....if installing a non Apple app can be done without messing with factory settings on the Mac. In Windows I remember that I needed to disable Norton and the Firewall in order for installation to occur.
Thanks. -
Suggest antivirus and firewall
Hi, im running a windows computer xp home service pack3,
I was having problems downloading films from itunes, and i suspected either a bug/virus in my computer
or conflict with security software in my computer was causing problems, So i wiped my computer and installed new version
of xp,Went onto itunes and downloaded film which seems to have downloaded okay,
I dont want the same problem so can anyone suggest please an antivirus and firewall for my computer [had pandacloud antivirus before] which shouldnt cause conflict problems with itunes?, Many thanks for any help given.WIndows XP has a fairly serviceable firewall built into it already. As long as you are connecting to the internet via a router there really shouldn't be too much to worry about. Back in the day of directly connected modems people were inadverntly exposing their file systems to anyone who chose to look. A quick visit to Sheilds Up! should let you know if there are any significant issues.
I tend to recommend AVG-Free as an AV solution for personal use. Don't install its toolbar or search redirector. Whatever AV package you use you may want to go into its advanced settings and exclude it from monitoring your iTunes folder. This should prevent any conflict between the AV and iTunes.
tt2 -
I've run into one roadblock after another with Cirrus (Stratus) - basically, even the Adobe Videophone example refuses to work in the 'real world' where there's a mix of NAT and firewall configurations outside the developer's control. (http://forums.adobe.com/message/1064983#1064983 and thread at http://forums.adobe.com/thread/736422?tstart=0)
My question is whether Flash Media Server 4 has the same sort of issues? We don't want to pay up to install and run our own FMS only to discover that we won't be able to provide a P2P service to our end users because they're scattered around the Internet with a mix of mobile devices and computers lying behind NAT and firewall devices that we can't predict.FMS4 and Cirrus should behave identically as far as facilitating P2P communications on the open Internet.
as the referenced article describes, with some combinations of NATs and firewalls, P2P communication is impossible. RTMFP tries really hard to establish connections in the cases where direct communication is possible, but will not function in cases where direct communication is not possible.
we believe direct communications should be possible for the majority of Internet users, but recognize that it won't be possible for 100% of users. -
I have a new macbook pro. Should I turn on File Vault and Firewall?
The purpose of FileVault is to protect your files from being read by someone who has physical access to the computer. If you need or want that protection, you should enable it.
The application firewall blocks incoming network traffic, regardless of origin, on a per-application basis. Typically, it would be configured to allow only applications digitally signed by Apple to listen on the network. It does not block outgoing traffic, nor can it distinguish between different sources of incoming traffic. It is not, as some people seem to believe, a malware filter.
So for example, suppose you enable file sharing, and allow access by guests to certain folders. You want people on your local network to be able to access those files without having to enter a password. When configured as stated above, the firewall will allow that. Your router will prevent outsiders from accessing the files, whether the application firewall is on or not. But if your computer is portable and you connect it to an untrusted network such as a public hotspot, the firewall will still allow access to anyone, which is not what you want.
Now suppose you unknowingly install a trojan that steals your data and uploads it to a remote server. The firewall, no matter how it's configured, will not block that outgoing traffic. It does nothing to protect you from that threat.
Another scenario: Your web browser is compromised by a trojan. The trojan redirects all your web traffic to a bogus server. The firewall does nothing to protect you from this threat.
A final scenario: You're running a public web server. Your router forwards TCP connection requests on port 80 to your Mac, and the connections are accepted by the built-in web server, which is signed by Apple. The application firewall, still configured as above, allows this to happen. Now you download a different trojan, one that tries to hijack port 80 and replace the built-in web server. The good news here is that the firewall does protect you; it blocks incoming connections to the trojan and alerts you. The bad news is that you've been rooted. The attacker who can do all this can just as easily disable the firewall, in which case it doesn't protect you after all.
It might make a bit of sense to use the firewall if you're running trusted services on an unprivileged port; that is, a port numbered higher than 1023. Those ports can be bound by a process with no special privileges.
Here is a more realistic scenario in which you should enable the firewall. Your portable Mac has several sharing services enabled. You want those services to be available to others on a home or office network. When you're on those networks, the firewall should be off. When you move to an untrusted network, you can either turn off all the services, or enable the firewall to block them. Blocking is easier: one configuration change instead of several. -
Load balancing, failover and fallback in Non-Clustered WebLogic environment
hi,
Has anyone implemented WebLogic 10.3.3 (or 10.3.4) in a Non-Clustered environment, but also got load balancing, failover and fallback work?
We were successful in getting failover working using t3://server1:7001,server2:7002 provider URL, but not load balancing or fallback.
The fallback is working when it was connecting to server2 and if we kill server2, then it switches to server1, but not when server2 is still running while server1 comes back.
All we need to find a way to enforce fallback to primary site, even if secondary which the client connected is still up and running and primary site comes back.
Any help appreciated.
Thanks.
Best regards,
Balahi,
Has anyone implemented WebLogic 10.3.3 (or 10.3.4) in a Non-Clustered environment, but also got load balancing, failover and fallback work?
We were successful in getting failover working using t3://server1:7001,server2:7002 provider URL, but not load balancing or fallback.
The fallback is working when it was connecting to server2 and if we kill server2, then it switches to server1, but not when server2 is still running while server1 comes back.
All we need to find a way to enforce fallback to primary site, even if secondary which the client connected is still up and running and primary site comes back.
Any help appreciated.
Thanks.
Best regards,
Bala -
Anti-Virus and Firewall Software for Windows (on my Intel Mac)?
Hello,
I have just ordered my first Intel Mac, as well as my first copy of Windows XP. How ironic that I would be asking this on the Apple Discussions site, but what Windows anti-virus and firewall software is recommended? I want to be well protected on the Windows side.
“Technological change is like an axe in the hands of a pathological criminal.” (Albert Einstein, 1941),
Dr. Z.Templeton,
It is embarrassing enough that I am installing a copy of Windoze on my brand new Mac, not to mention voluntarily opening myself up to a host of viruses, spyware, and other PC garbage. If I can’t trust another Mac user for help here, then who can I trust?
Thanks for your mere comment. Now, anyone else with actual knowledge to share?
“The future is here; it's just not evenly distributed yet.” (Albert Einstein, 1939),
Dr. Z. -
Hi looking for a bit of free anti - virus and firewall for osx 10.8.2
hi looking for a bit of free anti - virus and firewall for osx 10.8.2 any pointers also any one used Mac cleaner ?
1. This comment applies to malicious software ("malware") that's installed unwittingly by the victim of a network attack. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the victim's computer. That threat is in a different category, and there's no easy way to defend against it. If you have reason to suspect that you're the target of such an attack, you need expert help.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files. This feature is transparent to the user, but internally Apple calls it "XProtect." The recognition database is automatically updated once a day; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets (see below.)
It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
3. Starting with OS X 10.7.5, there has been another layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't actually been tested by Apple (unless it comes from the Mac App Store), but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. For most practical purposes, applications recognized by Gatekeeper as signed can be considered safe.
Gatekeeper has, however, the same limitations as XProtect, and in addition the following:
It can easily be disabled or overridden by the user.
A malware attacker could get control of a code-signing certificate under false pretenses, or could find some other way to evade Apple's controls.
For more information about Gatekeeper, see this Apple Support article.
4. Beyond XProtect and Gatekeeper, there’s no benefit, in most cases, from any other automated protection against malware. The first and best line of defense is always your own intelligence. All known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore reduces to a battle of wits between you and the malware attacker. If you're smarter than he thinks you are, you'll win.
That means, in practice, that you never use software that comes from an untrustworthy source. How do you know whether a source is trustworthy?
Any website that prompts you to install a “codec,” “plug-in,” or “certificate” that comes from that same site, or an unknown one, is untrustworthy.
A web operator who tells you that you have a “virus,” or that anything else is wrong with your computer, or that you have won a prize in a contest you never entered, is trying to commit a crime with you as the victim. (Some reputable websites did legitimately warn users who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
“Cracked” copies of commercial software downloaded from a bittorrent are likely to be infected.
Software with a corporate brand, such as Adobe Flash Player, must be downloaded directly from the developer’s website. No intermediary is acceptable.
5. Java on the network (not to be confused with JavaScript, to which it's not related) is a weak point in the security of any operating system. If a Java web plugin is not installed, don't install one unless you really need it. If it is installed, you should disable it (not JavaScript) in your web browsers. Few websites have Java content nowadays, so you won’t be missing much. This setting is mandatory in OS X 10.5.8 or earlier, because Java in those obsolete versions has known security flaws that make it unsafe to use on the Internet. The flaws will never be fixed. Regardless of version, experience has shown that Java can never be fully trusted, even if no vulnerabilities are publicly known at the moment.
Follow these guidelines, and you’ll be as safe from malware as you can reasonably be.
6. Never install any commercial "anti-virus" or "Internet security" products for the Mac, as they all do more harm than good. If you need to be able to detect Windows malware in your files, use the free software ClamXav — nothing else.
Why shouldn't you use commercial "anti-virus" products?
Their design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere.
In order to meet that nonexistent threat, the software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
By modifying the operating system, the software itself may create weaknesses that could be exploited by malware attackers.
7. ClamXav doesn't have these drawbacks. That doesn't mean it's entirely safe. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so can corrupt the Mail database. The messages should be deleted from within the Mail application.
ClamXav is not needed, and should not be relied upon, for protection against OS X malware. It's useful only for detecting Windows malware. If you don't need to do that, avoid it. Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else.
8. The greatest danger posed by anti-virus software, in my opinion, is its effect on human behavior. When people install such software, which does little or nothing to protect them from emerging threats, they get a false sense of security from it, and then they may do things that make them more vulnerable. Nothing can lessen the need for safe computing practices.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use. -
Anyone have Weblogic Server 5.1 and Firewall-1 mix authentication problems?
We have a Weblogic Server 5.1 instance running behind Firewall-1 from
Checkpoint. When an external client tries to connect, the following
happens:
1. an authentication dialog box from Firewall-1 pops up and once it
authenticates the user, then
2. ANOTHER authenticatino dialog box pops up from WLS but it says it is a
combo of both WLS and Firewall-1???
Bizzarre!
Ideally, Just one popup should occur or people should be able to athenticate
once in FW1 and then secondly in ONLY WLS realm (not some hybrid)
Any ideas / suggestions
Bart Jenkins, CTO, Globeflow SA
Madrid SpainBart,
Could you please provide more details? For example, what is it that makes
you believe that it is a combo?
I ask because there is no integration between the two products. I would
have expected that FW-1 would
prompt because it is authenticating the user and then WLS would prompt via
basic or form-based authentication
if the resource is protected.
Paul Patrick
"Bart Jenkins" <[email protected]> wrote in message
news:3a75efb6$[email protected]..
We have a Weblogic Server 5.1 instance running behind Firewall-1 from
Checkpoint. When an external client tries to connect, the following
happens:
1. an authentication dialog box from Firewall-1 pops up and once it
authenticates the user, then
2. ANOTHER authenticatino dialog box pops up from WLS but it says it is a
combo of both WLS and Firewall-1???
Bizzarre!
Ideally, Just one popup should occur or people should be able toathenticate
once in FW1 and then secondly in ONLY WLS realm (not some hybrid)
Any ideas / suggestions
Bart Jenkins, CTO, Globeflow SA
Madrid Spain -
i try to restore ipad to ios 7.0.4 but the tunes show error ,the ipad could not be restore because the firmware file was corrupt, i have the latest update from itunes and windows and i turn off antivirus and firewall and the error is the same , what i do?, my ipad is show apple logo
please what i doHello JD_NINJA,
Thanks for using Apple Support Communities.
Error 9006 when restoring your iOS device indicates that there is security software on your computer which is preventing connection to the Apple server or your device. To troubleshoot this issue please follow the directions below.
Check your security software
Related errors: 2, 4, 6, 9, 1611, 9006. Sometimes security software can stop your device from communicating with either the Apple update server or with your device.
Check your security software and settings to make sure that they aren't blocking a connection to the Apple servers.
Get help with iOS update and restore errors - Apple Support
When restoring your iPhone, please make sure to follow the directions in the link below to properly restore.
Restore your device from an iCloud or iTunes backup - Apple Support
Take care,
Alex H.
Maybe you are looking for
-
How to Connect Apple TV with dish anywhere app on ipad
How do I connect to Apple TV to sync with my iPad so I can watch movies with the Dish any where app? I keep getting a message saying an error occurred loading this content.
-
Job creation on particular days in week
hi All, OS : RHEL 5.7 DB : 11.2.0.2 I have created one job. I want to run one procedure from Monday to Saturday at 10AM. Below is my code. Please check the code and tell me is it correct because i dont have that much idea about scheduling a job. have
-
please help
-
How do I set up external storage and a Time Machine backup?
I am trying to organize my external storage for a new iMac with an 500G SSD drive. I have a new thunderbolt G-Raid drive and an aging Airport Time Capsule. I was thinking of storing music and pictures, as well as a Time Machine backup of the SSD, a
-
Need help with iphone email setup hosted through BC