SA540 Firewall Rules Fail when Optional Port Configured to Failover

Today, I configured a client's SA540 for failover. The primary WAN port is FIOS with a static IP address. The optional port is Road Runner cable with a static IP address. The failover tested successfully. However, now the SA540 cannot be accessed on its internal IP address (https://192.168.1.1) and none of the firewall rules work any longer. There are several rules but to name two; remote desktop port forwarding to an internal server, and HTTPS to another internal server. Both rules use IP addresses different than the SA540's WAN IP address. Additional external IP addresses were configured previously and assigned and they worked up to the point were the failover was configured.
Now here is the strange part. If the optional port cable is removed from the port, everything returns to normal, but plug it back in and problems. I even tried disabling failover in the SA540's configuration and it made no difference unless the cable was unplugged.
As you might imagine the client is upset about this. Anyone have any ideas?
The firmware is 2.1.18.
Tony
PS. About an hour after I posted this, I tried moving the remote desktop external connection from one of the additional IP addresses configured in the SA540 to the dedicated WAN address and remote desktop sessions were then forwarded into the correct server. Apparently, the additional IP addresses are not working with the two ISP failover configured, or at least it doesn't work in my configuration. Any help on this would be much appreciated. The additional IP addresses are configured in the same subnet as the dedicated (primary) WAN port. Again, this worked until failover with another ISP was configured.

This issue has been resolved. After much testing and discussions with the great guys at Cisco TAC, we determined that Verizon FIOS is doing something on their routers to defeat use of IP aliasing. If you have FIOS and you must have more than one IP address and expect to create an IP alias to direct traffic in a 1 to 1 NAT to a node on your network, FIOS doesn’t work. Contact with Verizon technical support is no help. They are oblivious to the problem and don’t want to be bothered.
Tony Lombardi

Similar Messages

SA540, firewall rules VPN - LAN?

Hi all,
how to set up firewall rules to limit access from VPN to LAN subnet?
Thanks!

Simple,
the VPN addresses are considered part of WAN side.
For some reasons the rules, even if present, were not triggered: a reboot solved the problem!

Adding a new server to Enterprise pool failing when installing local configuration store

We have Enterprise edition running. It includes one Enterprise pool, on director pool and one edge pool. SQL is installed on a separate backend server in default instance. No other databases on the same server.
The problem comes up when trying to add another server to the enterprise or director pool. Same error message is shown when trying to install the Local Configuration Store:
PS C:\Users\administrator.DOMAIN\appdata\local\temp\2> Import-CsConfiguration -FileName .\CSConfigData-2012_03_22-09_29_14.zip -Verbose -LocalStore
Import-CsConfiguration : The 'MaxPublishBatchSize' attribute is invalid - The value '100' is invalid according to its datatype 'PositiveInteger' - The MaxIncl
usive constraint failed.
At line:1 char:23
+ Import-CsConfiguration <<<< -FileName .\CSConfigData-2012_03_22-09_29_14.zip
-Verbose -LocalStore
    + CategoryInfo          : NotSpecified: (:) [Import-CsConfiguration], XmlS
   chemaValidationException
    + FullyQualifiedErrorId : System.Xml.Schema.XmlSchemaValidationException,M
   icrosoft.Rtc.Management.Xds.ImportConfigurationCmdlet
Same error comes from the GUI. Any ideas?

Hi,
run these commands earlier:
PS C:\Users\administrator.domain> Get-CsManagementStoreReplicationStatus -CentralManagementStoreStatus
LastUpdatedOn : 28.3.2012 12:51:03
ActiveMasterFqdn : LYNCFE-01.domain.local
ActiveMasterLastHeartBeat : 28.3.2012 12:51:42
ActiveFileTransferAgentFqdn : LYNCFE-01.domain.local
ActiveFileTransferAgentLastHeartBeat : 28.3.2012 12:51:41
ActiveReplicas : {lyncdir-01.domain.local, lyncfe-
01.domain.local, lyncedge-01.domain.lo
cal, lyncdir-02.domain.local}
DeletedReplicas : {}
PS C:\Users\administrator.domain> Invoke-CsManagementStoreReplication
PS C:\Users\administrator.domain> Get-CsManagementStoreReplicationStatus -CentralManagementStoreStatus
LastUpdatedOn : 28.3.2012 12:52:21
ActiveMasterFqdn : LYNCFE-01.domain.local
ActiveMasterLastHeartBeat : 28.3.2012 12:52:42
ActiveFileTransferAgentFqdn : LYNCFE-01.domain.local
ActiveFileTransferAgentLastHeartBeat : 28.3.2012 12:52:42
ActiveReplicas : {lyncdir-01.domain.local, lyncfe-
01.domain.local, lyncedge-01.domain.lo
cal, lyncdir-02.domain.local}
DeletedReplicas : {}
After that I tried to add the server again, same error message. I also tried to re-join the server to domain and even re-created the whole virtual server

SA540 firewall rule expcetion to allow boss access the block website

On SA540 URL Filter whole company block speific website
but the Boss want to access it those web site , any help

Hi Chammy, thank you for using our forum, my name is Luis I am part of the Small business Support community, I will be more than glad to assist you with your inconvenience, you need to set first the condition more specifics like the access for your boss, and then you can configure the general rules, in order.
I will share to you a document to guide your Access list configuration,
http://www6.nohold.net/CiscoSB/Loginr.aspx?login=1&pid=2&app=search&vw=1&articleid=704
I hope you find this answer useful
Greetings,
Luis Arias.
Cisco Network Support Engineer.

Install failing when running Database Configuration Assistant

I am trying to install Oracle 9i on a new Solaris 9 box. Everything goes fine until oui tries to run the Database Configuration Assistant. It is at the "Creating and starting Oracle Instance" stage that I get a popup which says:
ORA-27302: failure occured at: skgpwreset1
ORA-27303: additional information: invalid shared ctx
ORA-27146: post/wait initialization failed with
status:28
ORA-27301: OS failure message: No space left on device
ORA-27302: failure occured at: sskgpcreates
I don't understand the "No space left on device" as I have ~30 GB available. I am hoping it is a result of the invalid shared ctx above it. Other than this, the installation completes without any errors.
I have been banging my head against this for over a week! Does anyone have any suggestions. I am sorry I waited so long to post the question, but I could use some assistance urgently.
TIA,
Steve

Solution:
For Solaris 9 the (recommended) /etc/system parameters look like this:
set semsys:seminfo_semmni= 100
set semsys:seminfo_semmns= 1024
set semsys:seminfo_semmsl= 256
set shmsys:shminfo_shmmax=4294967295
set shmsys:shminfo_shmmni=100
The other parameters are not needed in this Solaris version.
I hope this is useful.

SA 540 INBOUND FIREWALL RULES NOT WORKING

Hi all,
I am having trouble configuring the firewall for the SA 540.
client 1 (160.222.46.154) ----- switch ------ sa 540 ------ cisco 887 W ------ client 2 (50.0.0.10).
client 1 can ping client 2, however client 2 cannot ping client 1. The default outbound policy (allow all) is set on the sa 540, and I have tried configuring a blanket ipv4 rule on the sa 540 to allow 'all' to 'any' (for all services) related to traffic from the WAN to LAN, and visa versa. The output from the logs are as follows:
Fri Jan 7 13:43:04 2000(GMT +1000) WARN FIREWALL 50.0.0.10 160.222.46.154 [firewall] LOG_PACKET[DROP] IN=WAN OUT=WAN SRC=50.0.0.10 DST=160.222.46.154 PROTO=ICMP TYPE=8 CODE=0
Component: KERNEL
Fri Jan 7 13:43:09 2000(GMT +1000) WARN FIREWALL 50.0.0.10 160.222.46.154 [firewall] LOG_PACKET[DROP] IN=WAN OUT=WAN SRC=50.0.0.10 DST=160.222.46.154 PROTO=ICMP TYPE=8 CODE=0
Component: KERNEL
Fri Jan 7 13:43:14 2000(GMT +1000) WARN FIREWALL 50.0.0.10 160.222.46.154 [firewall] LOG_PACKET[DROP] IN=WAN OUT=WAN SRC=50.0.0.10 DST=160.222.46.154 PROTO=UDP SPT=60737 DPT=53
Component: KERNEL
Basically any connection identified as coming in from the WAN (i.e. IN=WAN) is dropped. I set up a new vlan on the cisco 887 W, in the 160.222.46.x address space, and connected a spare port directly to the sa 540 and had no problem testing connectivity to any device via ping. Obviously the zone communication is LAN to LAN and firewall treats the traffice differently.
I assumed that creating an all encompassing rule to allow all trafiic, for all services, between the LAN and WAN (in both directions) would be equivalent to placing the appliance in PASS THROUGH mode? There is no securtiy set on the 887 W or the switch.
Also is anybody could explain what 'SELF' means in the conttext IN=SELF or OUT=SELF it would be much appreciated. Firmware is latest.
Thank you.
Regards
Marc

On closer analysis and with some help from Experts Exchange it did seem non sensical to have both the IN and OUT as the WAN interface, but I had literally exhausted every avenue possible bar 1- changing the routing mode to CLASSIC and configuring a static route (which was at a higher administrative level than my RIP advertised routes) and took preferece when forwarding the packets.
Now the SA540 firewall rules work as I would expect and I can route between all zones. To summise it appears as if the Double NAT from the router (887W) and then the SA540 was the issue, and the innability to configure any workaround in the interface of the SA54O firewall rules.
It really makes you appreciate the power of the command line and the full scope of CIsco's command line options. Does anybody know if (and how) it would be possible to configure Double NAT on the SA540?
Regards
Marc

0x8007000e (E_OUTOFMEMORY) while adding a firewall rule using the windows firewall COM API

Hello,
Configuration: Windows Embedded 8 64-bit.
I'm using the Windows Firewall with Advanced Security COM API. The program uses the INetFwRules interface. Basically, I'm using the following code (Form the code sample available here : http://msdn.microsoft.com/en-us/library/windows/desktop/dd339604%28v=vs.85%29.aspx.)
I get the error when performing "hr = pFwRules->Add(pFwRule);".
We can also encounter the problem when removing a rule (using pFwRules->Remove(ruleName);)
HRESULT hrComInit = S_OK;
HRESULT hr = S_OK;
INetFwPolicy2 *pNetFwPolicy2 = NULL;
INetFwRules *pFwRules = NULL;
INetFwRule *pFwRule = NULL;
long CurrentProfilesBitMask = 0;
BSTR bstrRuleName = SysAllocString(L"SERVICE_RULE");
BSTR bstrRuleDescription = SysAllocString(L"Allow incoming network traffic to myservice");
BSTR bstrRuleGroup = SysAllocString(L"Sample Rule Group");
BSTR bstrRuleApplication = SysAllocString(L"%systemroot%\\system32\\myservice.exe");
BSTR bstrRuleService = SysAllocString(L"myservicename");
BSTR bstrRuleLPorts = SysAllocString(L"135");
// Initialize COM.
hrComInit = CoInitializeEx(
0,
COINIT_APARTMENTTHREADED
// Ignore RPC_E_CHANGED_MODE; this just means that COM has already been
// initialized with a different mode. Since we don't care what the mode is,
// we'll just use the existing mode.
if (hrComInit != RPC_E_CHANGED_MODE)
if (FAILED(hrComInit))
printf("CoInitializeEx failed: 0x%08lx\n", hrComInit);
goto Cleanup;
// Retrieve INetFwPolicy2
hr = WFCOMInitialize(&pNetFwPolicy2);
if (FAILED(hr))
goto Cleanup;
// Retrieve INetFwRules
hr = pNetFwPolicy2->get_Rules(&pFwRules);
if (FAILED(hr))
printf("get_Rules failed: 0x%08lx\n", hr);
goto Cleanup;
// Create a new Firewall Rule object.
hr = CoCreateInstance(
__uuidof(NetFwRule),
NULL,
CLSCTX_INPROC_SERVER,
__uuidof(INetFwRule),
(void**)&pFwRule);
if (FAILED(hr))
printf("CoCreateInstance for Firewall Rule failed: 0x%08lx\n", hr);
goto Cleanup;
// Populate the Firewall Rule object
pFwRule->put_Name(bstrRuleName);
pFwRule->put_Description(bstrRuleDescription);
pFwRule->put_ApplicationName(bstrRuleApplication);
pFwRule->put_ServiceName(bstrRuleService);
pFwRule->put_Protocol(NET_FW_IP_PROTOCOL_TCP);
pFwRule->put_LocalPorts(bstrRuleLPorts);
pFwRule->put_Grouping(bstrRuleGroup);
pFwRule->put_Profiles(CurrentProfilesBitMask);
pFwRule->put_Action(NET_FW_ACTION_ALLOW);
pFwRule->put_Enabled(VARIANT_TRUE);
// Add the Firewall Rule
hr = pFwRules->Add(pFwRule);
if (FAILED(hr))
printf("Firewall Rule Add failed: 0x%08lx\n", hr);
goto Cleanup;
This works pretty well but, sometimes, at system startup, adding a rule ends up with the error 0x8007000e (E_OUTOFMEMORY) ! At startup, the system is always loaded cause several applications starts at the same time. But nothing abnormal. This is quite a random
issue.
According MSDN documentation, this error indicates that the system "failed to allocate the necessary memory".
I'm not convinced that we ran out of memory.
Has someone experienced such an issue? How to avoid this?
Thank you in advance.
Regards, -Ruben-

Does Windows 8 desktop have the same issue? Are you building a custom WE8S image, or are you using a full WE8S image? The reason I ask is to make sure you have the modules in the image to support the operation.
Is Windows Embedded 8.1 industry an option?
www.annabooks.com / www.seanliming.com / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

SA520 Optional port WAN mode for isolated network?

Long story short, client bought 2 SA520's, one for each site due to it's ability to have a second wan/lan port (Optional Port). They have a 2nd WAN connection installed that does not have internet. Esentially it is a hospital link that was install to gain access to some Citrix systems and custom web portals for hispital use.
The IDEA was to enable optional port for WAN mode. Then I was going to add a route statement that any traffic destined to the hospital network would route to the optional wan port,
Problem - When just enabling WAN port in Optional settings, the WAN port won't come online. I have to chose load balancing or failover. Neither of which are true; I don't want balancing or failover since it isn't a real "internet" connection.
I thought about setting port to LAN mode but it appears that simply makes the router a 5 port switch instead of 4. I was hoping I could just simply create a second LAN segment and route to it as well for certain traffic. Once I enable LAN mode however all configuration disappears and the Networking>LAN menu shows no specific Optional Port configuration options.
??? Can this not be configured as such? Saying it offers a optional port for LAN/WAN/DMZ configurations sort of means doing what I need it to do. I'm missing something, somewhere.
Help!
Eric

Hi Eric,
One thing you can do is to enable the Optional WAN port. Set the 'WAN Mode' to load balancing. Then use the 'Protocol' Bindings' to handle your routes. You would configure your Hospital network IP network range as the destination network and select your Optional WAN. Another rule would be a destination of ANY for the Destination that would go out the dedicated WAN. You may have to add a rule for DNS resolution to go through your hospital network so the local hospital DNS entries resolve.
Hope this helps.
Chris

ISA 550 Firewall Rule - how to specify a domain (to resolve a DDNS)

I want to lock down access to an ISA 550 Firewall to 4 locations. 2 of the locations have dynamic IP addresses.
Both sites have a dynamic domain maintained at no-ip.org.
How can I enter 'name.no-ip.org' in to a firewall rule?

There is not a way to use a domain name in a firewall rule. When the traffic comes in the packets are addressed with IPs, not with domain names, so when the router looks things up it compares IP addresses.
In fact I have never seen this done, even on an enterprise device. I'm not saying nothing can do it, but it definitely isn't possible with the ISA.
Your best bet would be to try and get some static IPs for those two sites as well.
It is however possible to setup site-to-site VPNs between these devices even if some of them are using DDNS. This does require those other site's routers to support site-to-site tunnels. That way those four sites would be able to access resources behind the ISA, but no one else would, and you could still keep using the DDNS for the two dynamic sites.
Thank you for choosing Cisco,
Christopher Ebert
Network Support Engineer - Cisco Small Business Support Center
*please mark/rate helpful answers*

JBoss configuration failed on verifying ports

Dear all,
I am trying to install Adobe LiveCycle ES3 on a server where another Tomcat instance is already running. However, the JBoss service starts successfully. When executing the LiveCycle Configuration manager for lc_turnkey I get the error "Failure on verifying ports. Specifically the message is referring to port 4444 which is in use by the Tomcat instance. I already changed the configuration of bindings-jboss-beans.xml within [JBoss root]\server\lc_turnkey\conf\bindingservice.beans\META-INF by replacing port 4444 with port 9444 (which is not in use) for the Socket for the legacy RMI/JRMP invoker. However, the configuration manager seems not to read the cahnged xml file.
Any hints or advices?
Best regards
Rene

Hi Santosh,
thanks for this advice. Yes indeed I've set the parameter to ports-03. However it seems that when installing with lc_turnkey option the port 4444 for the JBoss server is programmed. I needed to change the listener port of the other application running on the system to get Adobe LC ES3 running.
Best regards
Rene
Am 08.08.2013 um 04:52 schrieb N Santosh Kumar:
Re: JBoss configuration failed on verifying ports
created by N Santosh Kumar in LiveCycle installation, configuration, deployment, and administration - View the full discussion
Hi Rene,
Have you tried -Djboss.service.binding.set=ports-01 parameter as JBoss startup parameter.
This is a feature of JBoss which adds 100 to each port it uses , JBoss uses 4544 instead of 4444 automatically.
--Santosh
Please note that the Adobe Forums do not accept email attachments. If you want to embed a screen image in your message please visit the thread in the forum to embed the image at http://forums.adobe.com/message/5575978#5575978
Replies to this message go to everyone subscribed to this thread, not directly to the person who posted the message. To post a reply, either reply to this email or visit the message page: http://forums.adobe.com/message/5575978#5575978
To unsubscribe from this thread, please visit the message page at http://forums.adobe.com/message/5575978#5575978. In the Actions box on the right, click the Stop Email Notifications link.
Start a new discussion in LiveCycle installation, configuration, deployment, and administration by email or at Adobe Community
For more information about maintaining your forum email notifications please go to http://forums.adobe.com/message/2936746#2936746.

Failed to update server firewall rules

Hi
I have a problem with the SQL firewall. Unfortunately, I can not add IP address. It always comes this error when saving: Failed to update server firewall rules
How can I change this? I need to change this setting so that I can work again. Unfortunately, I do not want to help the Support of Microsoft !!

Hi,
To configure your firewall, you create firewall rules that specify ranges of acceptable IP addresses. You can create firewall rules at the
server and database levels.
Server-level firewall rules: These rules enable clients to access your entire Azure SQL Database server, that is, all the databases within the same logical server. These rules are stored in the
master database.
Database-level firewall rules: These rules enable clients to access individual databases within your Azure SQL Database server. These rules are created per database and are stored in the individual databases (including
master). These rules can be helpful in restricting access to certain (secure) databases within the same logical server.
For additional information check this below link
http://msdn.microsoft.com/en-us/library/azure/ee621782.aspx
http://social.technet.microsoft.com/wiki/contents/articles/2677.windows-azure-sql-database-firewall-en-us.aspx
http://social.msdn.microsoft.com/Forums/azure/en-US/ea128f00-8a94-4ace-88ff-d7095ff60c1a/cannot-change-firewall-setting-for-sql-azure-after-ip-change?forum=ssdsgetstarted
Girish Prajwal

Applications fail when "mpls mtu 1526" is configured

Hi,
I'm facing an issue with an MPLS VPN backbone.
A customer's IP host at one location can ping and traceroute to application servers at it's central site at another location. The IP path traverses four P/PE routers, as follows:
IP Host (spoke site) -- CE1 -- P/PE1 -- P/PE2 -- P/PE3 -- P/PE4 -- CE2 -- Servers (central site)
However, access to all applications fails.
Network configurations as follows:
(1) All the P/PE routers are Cisco 7609, SUP720-3BXL, IOS 12.2(18)SXF6.
(2) All the core links are configured with "mpls mtu 1526".
(3) All the core links are GE, connected to SPA-2X1GE on a 7600-SIP-400 linecard. Some connect to the SFP port on the SUP720.
(4) Only some of the P/PE routers are configured with "ip tcp path-mtu-discovery".
After removing the command "mpls mtu 1526" from all core links, access to all applications and services works again.
Please advise if I've configured anything wrongly.
Thank you.
B.Rgds,
Lim TS

There are two ways to look at this,
1) First To solve the problem, on all your Core and Core Facings links configure "mtu 1526 or larger" (PE-P, P-P) mtu 1526 or larger.
2) Second "MPLS MTU 1526" command only helps in labelling the fragmented payload which is beyond 1526. Till then if anything is fragmented it doesnt label the fragments.
So now why does it work when its removed,
a) verify what is your actual link mtu.
b) "mpls mtu" command doesnt change the physical mtu it just tells the IOS when to label fragments. and the 1526 is the threshold to fragment the labelled packet and label the fragments also.
c) One important thing to note is even when you dont configure the "mpls mtu" command it is still there by default but now it uses the MTU value of the physical link, so if your link is of 1500 MTU the default "mpls mtu" is also 1500.!
d) also go through this previous thread for more information the same topic has been discussed at length.
MPLS: MTU Ethernet MPLS Network Sep 26, 2006
HTH-Cheers,
Swaroop.

Fail when config "Internet Directory Configuration Assistant"

I install oracle9ias( Infrastructure ) in AIX4.3.3 .
It failed when config "Internet Directory Configuration Assistant"
error message:
No output aviaible for this tool

the solution is
1- I removed the Network cable
2- I formatted the server
3- I Installed the Application Server
4- I Connected the server with network and I gave a static IP to the server
Best of Luck
Edited by: user13011851 on Jan 11, 2011 2:40 AM

SA540 Optional Port problem

We have a client with 2 SA540 units both connecting back to a SA520 with ipsec tunnels. Nothing out of the oridinary really. We did have some VOIP QoS settings that never really worked so the client opted to add a Time Warner Roadrunner cable connection (8mbx1.5mb) connection. The idea here then is to run the phones off the T1 interface and move web traffic to the cable modem connection.
We have a monitoring package (Labtech) running on all machines that report to out central server at our office.
So we got the cable installed and got static IP information. I enabled the optional port for WAN, Load balancing. Entered all the IP info. Tested with trace route from the router to the cable modem gateway, all ok.
Went to protocol bindings and enter a binding that "any source for service 80/443 destined to our IP address" would route through the optional port for testing. On the monitoring system, I noticed after about 3 minutes the clients started going black in that they had stopped reporting to the server. I went and modified the binding (or confirming I should say) and all looked ok. I disabled it, and all the clients popped back online. Renabled, all the clients started dropping again.
Scratched my head for a minute and then it happened. The client called in and said they had lost all phones and computers dropped off internet and they were down hard. What??!!! I disabled optional port, call the client and by the time the manager got on the phone he said the phones came back on and the computers were getting to their hosted app again.
What gives? Load balancing A) should have not stopped the internet from working all together and B) the protocol binding should have only effected the port 80/443 traffic that was destined to our server anyway (which the only service on the machines that comes to that specific IP is the labtech monitoring agents).
Ideas on what happened? Now the client won't let me touch it again until later this week but I'm at a loss as to why it killed the entire network.
It is running a revision notch or so old on firmware (2.0.17? It isn't the newest 2.02 I know that).
Any ideas would be heplful.

Good morning
Hi Eric, thanks for using our forum, my name is Johnnatan and I am part of the Small business Support community. Can you please reach out to our Small Business Support Center and open a Service Request to address this issue? One of our Engineers may be able to work with you and diagnose the root cause. You can find the appropriate contact information for SBSC in the below link.
http://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html
Before you call them I recommend you to upgrade your firmware and perform a factory reset(always do a backup of your information). I hope you find this answer useful,
*Please mark the question as Answered or rate it so other users can benefit from it*
Greetings,
Johnnatan Rodriguez Miranda.
Cisco Network Support Engineer.

When the program gets terminated unexpectedly (power failure, UPS fails), when I reopen it, it usually does NOT return the previous pages, as I have checked in the 'options' box,

# Question
When the program gets terminated unexpectedly (power failure, UPS fails), when I reopen it, it usually does NOT return the previous pages, as I have checked in the 'options' box, but goes to some random collection of pages often from months ago. Very frustrating - can anything be done to COMMAND it to save current pages and re-open there? (As I said, I have this box checked in the options, but it does not work ..

Very Important, how much Free Space is on your Hard Drive first of all? Click on the Macintosh HD on the Desktop, then do a Get Info on it.
Could be many things, we should start with this...
"Try Disk Utility
1. Insert the Mac OS X Install disc, then restart the computer while holding the C key.
2. When your computer finishes starting up from the disc, choose Disk Utility from the Installer menu at top of the screen. (In Mac OS X 10.4 or later, you must select your language first.)
*Important: Do not click Continue in the first screen of the Installer. If you do, you must restart from the disc again to access Disk Utility.*
3. Click the First Aid tab.
4. Select your Mac OS X volume.
5. Click Repair Disk, (not Repair Permissions). Disk Utility checks and repairs the disk."
http://docs.info.apple.com/article.html?artnum=106214
Then try a Safe Boot, (holding Shift key down at bootup), run Disk Utility in Applications>Utilities, then highlight your drive, click on Repair Permissions, reboot when it completes.
(Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive.)
If perchance you can't find your install Disc, at least try it from the Safe Boot part onward.
Do they launch OK while in Safe Mode?

SA540 Firewall Rules Fail when Optional Port Configured to Failover

Similar Messages

Maybe you are looking for