WAAS and Checkpoint compatibility.

Hello
Is there such a thing? Can I hope to install a WAE behind a Checkpoint firewall? Should I use tunnel mode udp 4050?
I´ve run into a paper that suggests using "Wire Mode" on Checkpoint.
Are there alternatives? Did someone out there have to do anything like this?
Thanks a lot.
GG

Thanks for your replies. The following rules were modified and waas worked just fine.
Sequence Verifier
http://www.checkpoint.com/defense/advisories/public/2004/cpai-2004-17.html
Packet Sanity
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1071
Thanks again
Guido

Similar Messages

I have a serious (and bizarre!) issue with my novation impulse (Although i've tried it with two other keyboards and i still have the same problem) and its compatibility with mainstage 3

i have a serious (and bizarre!) issue with my novation impulse (Although i've tried it with two other keyboards and i still have the same problem) and its compatibility with mainstage 3.
the problem is best explained on the following one - page thread:
https://discussions.apple.com/thread/3951518?start=0&tstart=0
(Clearly i'm not alone in this problem, although i think i figured out what's going wrong a little more than he did...read on!)
his solution, to put mainstage in jump mode, is very unsatisfactory to me, as it bounces all of a sudden to drastically different settings.
basically, my analysis is that my controller is NOT receiving MIDI date from mainstage. in other words, mainstage knows what my controller is doing, but my controller doens't know what mainstage is doing.
let's say i turn the knob all the way to the right ... 127...and the virtual fader goes to the right like it's supposed to.
now...next...let's say i change to a different patch, where that same VIRTUAL fader is not at the max clockwise position..maybe it's only at 1pm. now when i turn the physical knob to the RIGHT, the midi data is still at 127 on the controller! it didn't "reset" to sync up with the new level (say 80 or so) setting on the new patch. so i can't increase that new setting of 80 by continuing to turn the knob to the right. i have to turn it all the way to zero,...and then continue PAST zero until the controller thinks that IT is at 0...at that point the controller and mainstage are in agreement, and things work fine....so bascially, the keyboard thinks the level is at max...but mainstage thinks the level is at 1pm.
i am using Logic 9, and i have a macbook pro 2.9 Ghz I7 with 8 gigs of memory and OS X 10.8.4

Hi Josh,
Thanks for taking the time to contact us here a Novation for technical support. Lets continue to correspond via email so we can get your issue resolved.
Thanks.
Mike Towns

How can I get the Microsoft enhanced Point and Print compatibility driver installed on Win7 LC master?

We recently migrated from a Windows Server 2003 to Windows Server 2012 print server. When recomposing a linked clone pool with the old 2003 server, drivers were taken care of for the printer when the user printed for the first time after desktop recompose. With 2012, any printer using the Point and Print driver doesn't seem to obtain the driver again from the 2012 server. All of our clients are running Windows 7 which means the Microsoft enhanced Point and Print compatibility driver is not installed in the OS natively.
I apparently need to figure out a way to get this installed on the host image so it trickles down to snapshots when recomposing the linked clone pool but I haven't been able to dig much information on doing this. Does anyone out there have any insight on how to accomplish this? If I recompose a pool now for a user who is using a new Point and Print driver, they get the following message that is resolved by removing the printer from their account and re-adding it:
"The 'Microsoft enhanced Point and Print compatibility driver' printer driver is not installed on this computer. Some printer properties will not be accessible unless you install the printer driver. Do you want to install the driver now?"
I figured the easy solution would be to just install a printer using the Point and Print driver and then remove it...leaving the driver behind (unless it cleaned up after itself). The problem with this is in my testing, even after removing and re-adding a printer that set off installation of this Point and Print driver on the client, any other printer that was using it still required the remove/re-add process in order to work, else I got the same message. That tells me that the driver may be custom for each printer installed?
Color me a little confused. I do NOT like the way that Server 2012 handles printers. I've come across a few other issues as well (such as duplex capabilities not being remember on the print server for a printer) that I never had with the 2003 server.
Thanks!!

I was able to get it to work using your instructions off of here and your other thread
Thank you!
Chris
http://social.technet.microsoft.com/Forums/en-US/864553c2-c8ff-49d2-bd48-eb7b47381111/windows-2012-print-server-problem-with-xp-clients?prof=required

Block size in tt for writing data to transaction log and checkpoint files

Hello,
what block size is TimesTen using when its writing data to transaction log and checkpoint files? Does it use some fixed block size during filesystem writes?

Although in theory logging can write 2 KB blocks in almost all circumstances it will write 4 KB or larger so yes a filesystem with a 4 KB block size is fine for both checkpointing and logging.
Chris

IPhoto 6 and Camera Compatibility

I recently upgraded my OS to 10.5.8 from 10.4... I know very late. I had no intention until the upgrade to my iPhone 3GS required it. Regardless, I am running IPhoto 6.0.6 and it has worked fine. I own a Canon T1i EOS Rebel digital camera. Up until the conversion to Leopard, I would plug the camera into the port and iPhoto would open up and transfer the pics without an issue. Today, I tried to upload pictures, the USB cord was secure on both sides and nothing happened. I turned the camera on and off twice to see if by starting it up connected would change things, nothing did. I ensured that the battery is charged in the camera and that the sleep setting was not tampered with thus not allowing it to transfer.
I am suspicious about the upgrade to Leopard causing this incompatibility issue with my camera. When I did a search on the apple website, the page about iPhoto 6 and camera compatibility is a dead link. So a couple of questions if someone would be kind enough to help me out with:
1) Is the import of pictures not occuring because of an incompatibility issue between my camera and iPhoto 6 suddenly? Or is incompatibility between 10.5.8 and iPhoto 6?
2) What is the best solution? Upgrade to iLife '11? Or will that require upgrading to Snow Leopard as well? Or is it better to buy the $129 bundle of Snow Leopard, iLife and iWork for compatibility issues?
3) Lastly, is there a webpage on apple that shows these compatibility issues? For instance, if I upgrade one thing in the future, all the other software suites that need updating as well?
Thanks in advance to whomever can help me.
Cheers,
-Tod

1) Is the import of pictures not occuring because of an incompatibility issue between my camera and iPhoto 6 suddenly? Or is incompatibility between 10.5.8 and iPhoto 6?
Neither. The usual cause for this issue can be a damaged plist file, a setting on the camera or Mac or minor directory damage on the card.
Plist file: Can you access the card with Image Capture (in your Applications Folder)? If so, you might try trash the iPhoto plist file, if not try trash the Image Capture plist file as well.
Settings: What's set to happen when you connect the camera? With iPhoto 6 that's in the Image Capture. Your camera has two modes for talking to the Mac: Mass Storage and PTP. What one are you set to? Try the other one.
Directory Damage: Have you tried using a USB Card Reader? Can the Mac see the card in that?
Regards
TD

Info regarding Diswarrior 4 and Leopard compatibility

I emailed Alsoft regarding Diskwarrior 4 and Leopard compatibility. Here is the response I got.
+DiskWarrior 4.0 will successfully rebuild a disk that has Mac OS X 10.5+
+Leopard installed or a disk that has been attached to a computer running+
Leopard.
+However, some operating system functionality has changed within Leopard+
+itself. As such, there are some compatibility issues when running an+
+installed copy of DiskWarrior 4.0 while started up from Mac OS X 10.5+
+Leopard. Alsoft currently recommends that you do not run DiskWarrior 4.0+
+while the computer is started from Mac OS X 10.5 Leopard.+
+Instead, to run DiskWarrior, you should start up the computer from either:+
+1) A DiskWarrior 4.0 CD.+
+2) Any disk that starts up in 10.4.x and then run DiskWarrior 4.0.+
+An updated version of DiskWarrior that has complete Leopard+
+compatibility will be released soon as a free download for existing+
+owners of DiskWarrior 4.0.+
+-- What you can expect when running DiskWarrior 4.0 under Mac OS X+
+10.4.x and rebuilding a Leopard disk.+
+All features work as expected with one exception: FileVaults created+
+while started from Leopard are not visible to DiskWarrior 4.0 and cannot+
+be rebuilt (repaired).+
+-- What you can expect when running DiskWarrior 4.0 under Mac OS X 10.5+
+and rebuilding a Leopard disk.+
+While not recommended (and discouraged), if you do run DiskWarrior 4.0+
+while started from Mac OS X 10.5 you might encounter some problems such as:+
+1) There is a lengthy delay whenever DiskWarrior is determining which+
+drives are currently attached. This delay is dependent upon the number+
+of attached drives and may last up to 2 or 3 minutes. You will+
+experience this delay when first starting DiskWarrior, whenever a disk+
+is attached or detached while DiskWarrior is running but idle, and+
+whenever a rebuild is completed or canceled.+
+2) You cannot rebuild FileVaults or disk images.+
+3) In step 9 (comparing directories) of a rebuild, the progress bar+
+might get to 100% even though the comparison step is not finished.+
+4) When performing Check All Files and Folders the progress bar might+
+get to 100% even though the check is not finished.+
+5) After rebuilding a disk, DiskWarrior may report that some files or+
+folders have had their permissions changed. This is inaccurate and the+
+permissions have not been changed.+
+To repeat, an updated version of DiskWarrior that has complete Leopard+
+compatibility will be released soon as a free download for existing+
+owners of DiskWarrior 4.0.+
+-- What about DiskWarrior 3?+
+DiskWarrior 3 and earlier versions are not compatible with Mac OS X 10.5+
+(Leopard). Alsoft does not recommend running DiskWarrior 3 or earlier on+
+a disk that has Mac OS X 10.5 Leopard installed or a disk that has been+
+attached to a computer running Leopard.+
+-- Marc+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Marc Moorash, Alsoft Technical Support+
+Email: [email protected]+
So, it seems it will work but you need to run it from the disk or if you have it installed on a external drive running Tiger, it will work.
Thom

If you open your Tiger Address Book, select all cards, drag them to the desktop, it will make one big "mega-VCF" card with a name like "Alan Adams and 543 others.vcf" Dump that to a flash drive or email it to yourself, then doubleclick on it on the Leopard machine. They will all import just fine into your Leopard Address Book.
Try doing something similar with your iCal data, Open the application, choose your calendars one at a time, and select File > Export. That should make a big "mega-ics" calendar card with a name like "work.ics" or "home.ics, i.e., "originalcalendarname.ics" with all the events of that calendar. Then same drill: dump that to a flash drive or email it to yourself, then doubleclick on it on the Leopard machine.
Both generation methods create text files, which should import just fine into the Leopard applications.

RADIUS and CHECKPOINT and NORTEL

I have installed the NMAS modules from Border Manager 3.8 onto a Netware 6 SP3 box. I installed per TID 10078616 and can authenicate from my W2K workstation fine.
I am now trying to authenicate from a Nortel switch and a VPN from a checkpoint firewall. So far I have installed all of the login methods and I still get an unknown RADIUS client on the RADIUS server, when loging in from the Nortel switch. I have not tried to authenicate from the checkpoint firewall yet.
Does anyone have pointers as to the configuration to use the RADIUS server with Nortel or Checkpoint or a pointer to a technical description of the various login methods?
John

John,
I have a very similar problem with our 3com switches, can you give me more
details of what you did to get it working?
Thanks a lot,
Matt Hudson
(CNE6.5)
"John Curran" <[email protected]> wrote in message
news:[email protected]...
> Thank you very much, Jordack. The instructions were clear and concise.
>
> We go the Checkpoint firewall to authenicate VPN's with the RADIUS server.
>
> Also, I got the information from Nortel to allow authenication. I had to
> set up the Radius server to allow Service-Type Administrative and
> Service-Type NAS-Prompt. Then I had to go into each user and set up
> one of the service types.
>
> Thanks for your help.
>
> John
>
>
> >>> Jordack<[email protected]> 01/26 9:36 AM >>>
> I uploaded a quick draft guide. It should help.
>
> http://www.thiscorner.com/guides/cp-radius.pdf
>
> Jordack
>
> "John Curran" <[email protected]> wrote in message
> news:[email protected]...
> > Thanks for the input. I will get that book.
> >
> > With the Nortel switch it is curious. I had forgotten to add the switch
> > to the client list. When I did, the radius server accepts the
> > authenication and sends an accpt message, but the Nortel switch says
> > access denied. I put a Sniffer on the link and the accept message looks
> > just like any other accept message (follows RFC 2865). I have a feeling
> > Nortel does not follow RFC 2865 or does not like the authenication ID
for
> > some reason. I guess I will have to work more with Nortel to resolve
that
> > one.
> >
> > John
> >
> >
> >>>> Jordack<[email protected]> 01/26 7:53 AM >>>
> > Sorry about not responding, I saw your post and meant to dig up my
notes
> > and respond.
> >
> > I don't know much about the Nortel stuff.
> >
> > Make sure you have added the IP address of your Nortel and Checkpoint
box
> > to
> > the 'Clients' page of the 'Radius:Dial access System". The DAS will
only
> > except connections from known clients. From the sounds of it that might
> > be
> > the issue.
> >
> > For the CheckPoint Setup stuff there is a few things you will need to do
> > on
> > the Checkpoint Box.
> >
> > I used this book http://www.syngress.com/catalog/chapter.cfm?pid=25903
and
> > Everything worked.
> >
> > I was working on a small guide for CheckPoint radius but got pulled to
> > other
> > things. If I get it finished Ill post it
> >
> >
> > "John Curran" <[email protected]> wrote in message
> > news:[email protected]...
> >>I have installed the NMAS modules from Border Manager 3.8 onto a Netware
6
> >>SP3 box. I installed per TID 10078616 and can authenicate from my W2K
> >>workstation fine.
> >>
> >> I am now trying to authenicate from a Nortel switch and a VPN from a
> >> checkpoint firewall. So far I have installed all of the login methods
> >> and
> >> I still get an unknown RADIUS client on the RADIUS server, when loging
in
> >> from the Nortel switch. I have not tried to authenicate from the
> >> checkpoint firewall yet.
> >>
> >> Does anyone have pointers as to the configuration to use the RADIUS
> >> server
> >> with Nortel or Checkpoint or a pointer to a technical description of
the
> >> various login methods?
> >>
> >> John
> >>
> >
> >
> >
> >
>
>
>
>

WAAS and IP SLA operation

we are currently using the IP SLA udp jitter measurement to monitor our voice paths accross the WAN. If we implement a partial WAAS across the same WAN the voice traffic will be acellerated but not the IP SLA jitter measurement. Does this mean that when WAAS is implemented IP SLA is limited in its use?

Hi Steve,
The answer to your question depends on 1) how you deploy WAAS and 2) how you use IP SLA. If you deploy WAAS using WCCP for interception, UDP traffic will never be intercepted. If the WAAS device is deployed inline, all traffic flows through the WAAS device, so an IP SLA probe using UDP will be subject to WAAS pass-through handling behavior.
What are you trying to measure with regards to WAAS?
Zach

Seagate ST9750420AS HDD and W700ds compatability issue

There seems to be a compatability issue with the Seagate 750GB drives (ST9750420AS) and the W700ds (and possibly other W series notebooks).
With the controller set to RAID in BIOS Windows 7 and possibly other OSs can not access the HDDs. This configuration results in a 7B "inaccessable boot device" error BSOD.
Testing revealed only the ST9750420AS with FW 0001SDM5 (the only FW avaible) results in the 7B BSOD regardless of the RAID driver version installed. I have not phiscally removed the Turbo memory device to see if it plays a role in the problem or not.
The W700ds (2757) system I have available to test is compatable with the following Seagate (drives with various FW versions):
ST9160823ASG
ST9500325AS
ST9500420ASG
ST9500420AS
ST9640320AS
These were tested with Widows XPP 32bit, Windows 7 64bit and Linux 64 bit, these were tested in both RAID and non RAID configurations.
And not compatable with:
ST9750420AS, tested with Windosw 7 x64 in RAID configuration.
Any comments, corrections or resolution welcom.
Thanks
JMG

Hi Jamessts,
Welcome to the HP Forums!
I have read your post on installing your HDD to your HP computer, and I would be happy to be of assistance!
To determine your product specifications, I will need to know what the Product and Model Number of your desktop is. The next piece of information I will need is the version of Windows you have on your computer.
Since you stated that the HDD works in another computer, I suggest following this resource: "Windows could not complete the installation..." solved by MarkBeacom. This should help in setting up your HDD for use on your computer.
Please post back with the results of your troubleshooting, and I will diligently follow up with you!
Cheers
MechPilot
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the right to say “Thanks” for helping!

[solved] Dependency hell with redland and redland-compat

It seems that redland and redland-compat are in conflict, but both are required.
I notice that the installed version of redland-compat provides redland, but the new version does not.
$ pacman -Qu
redland-compat 1.0.12-1
skype 2.1.0.81-5.1
$ sudo pacman -Su
:: Starting full system upgrade...
warning: skype: ignoring package upgrade (2.1.0.81-5.1 => 2.2.0.25-1)
resolving dependencies...
looking for inter-conflicts...
error: failed to prepare transaction (could not satisfy dependencies)
:: audacity: requires redland
:: libreoffice: requires redland
$ sudo pacman -S redland
resolving dependencies...
looking for inter-conflicts...
:: redland and redland-compat are in conflict. Remove redland-compat? [y/N] y
error: failed to prepare transaction (could not satisfy dependencies)
:: redland-compat-storage-virtuoso: requires redland-compat
:: soprano: requires redland-compat
Last edited by jlindgren (2011-04-28 03:41:39)

sl1pkn07@sL1pKn07 pacman.d]$ yaourt -S redland
Contraseña:
resolviendo dependencias...
verificando conflictos...
Objetivos (2): rasqal-0.9.25-1 [0,22 MB] redland-1.0.13-1 [0,18 MB]
Tamaño total de descarga: 0,00 MB
Tamaño total instalado: 3,44 MB
¿Continuar con la instalación? [S/n] s
(2/2) verificando la integridad de los paquetes [---------------------------------------------------------------------------------------] 100%
(2/2) verificando conflictos entre archivos [---------------------------------------------------------------------------------------] 100%
error: error al realizar la transacción (archivos en conflicto)
redland: /usr/lib/librdf.so.0 existe en el sistema de archivos
redland: /usr/lib/librdf.so.0.0.0 existe en el sistema de archivos
[sl1pkn07@sL1pKn07 pacman.d]$ yaourt -Qo /usr/lib/librdf.so.0
/usr/lib/librdf.so.0 es propiedad de redland-compat 1.0.12-3
[sl1pkn07@sL1pKn07 pacman.d]$
sorry. menssage in spanish

WAAS and Juniper Netscreen Interoperability

I've been doing a dig on historical posts relating to WAAS deployed through firewalls.
I am working on a deployment with Juniper Netscreens & ASA5520 sitting between WAE's. IP connectivity is fine. I can ssh to remote device etc. but users cannot login (XP). The login scripts calls upon CIFS etc and I suspect this is being broken through the fw's.
When I disable WAAS for this flow - it all works fine i.e. users can login and access full set of corporate resources. I suspect the firewalls but would appreciate any leads..
thanks
Ajaz

Hi Ajaz,
WAAS adds TCP Option 0x21 and increments TCP packet sequence number during TCP handshake. FW needs to be configured to allow
these changes.
On the latest PIX/ASA a new command "ip inspect waas" has been added to allow above changes by wae. You might want to check
Netscreen config guide on command to disable TCP sequence number checking.
If SSH to Servers is working fine then it might not be FW dropping packets. However to confirm it might be best to use
tcpdump/tethereal on both WAEs and to sniff the traffic on whether its being dropped along the path by the FW.
Few questions:
- Whats the version running on WAEs?
- Is it only CIFS traffic which is affected? Try disabling CIFS AO if its enabled and then test.
Hope this helps,
Best Regards,
Rahul Vavale

WAAS and TACACS

We are trying to get our WAAS environment to authenticate against TACACS and then fall over to local if TACACS is unavailable. For engineer logins everything is working as expected. However we are seeing several thousand failures against the TACACS server from a username of "CMS". This user is not configured in the CM or in TACACS. So we log the failed login and CMS logs into the WAE due to the failover to local mechanism. Looking at packet captures, and debugging aaa on the WAE's it is definitely a CMS user that logs in but shows 127.0.0.1 as its "from" host. I am fairly confident this is automation within the WAE syncing with the CM or vice versa. Does anyone know how to get WAAS and TACACS to work together without a mass amount of login failures? Is there a way this CMS user can be cloned/duplicated on the tacacs server? What is the password for this automation user?
Thanks in advance.

Hi Stan,
WAE can authenticate against TACACS, RADIUS and Central Manager (Local) at any time depending on your configuration.
There are couple of things to keep in mind while configuring TACACS on WAE, on both sides - TACACS adn WAE CM.
On TACACS side:
1. Please make sure to create right username.
2. Please make sure to verify if you are using ASCII password authentication.
3. Try to use less than 15 letters - Alphanumeric TACACS password.
4. Please provide right user level / group level persmissions. This is somewhere under user account properties. Please also make sure to select right user password under user properties.
5. Verify if this user needs level 15 (admin equivalent account).
On WAE CM side:
1. Please make sure to select right authentication method as primary and secondary.
2. Please make sure to enable the check box for authentication methods.
You can verify the failure / successful log events on TACACS server in order to find out if the user is atleast trying to authenticate against TACACS.
I am sure you have looked at this link to find out all the required steps: Configuring TACACS+ Server Settings
Hope this helps.
Regards.
PS: Please mark this as Answered, if this resolves your issue.

WAAS and Symantec Vertitas Volume Replicator

Hi,
We are forwarding Symantec replication traffic via our WAAS infrastructure over a 20Mb WAN link. The CM appears to register the traffic but does not optimize it at all. Has anyone had any experience with WAAS and Symantec Veritas Volume Replicator (VVR) 4.3?

I tested with VVR in the lab. VVR default uses UDP and using the nerd knob in the GUI did not force VVR to start using TCP. To get VVR to use TCP, I had to input these commands:
vrport data 1999-1999
vrport heartbeat 2000-2000
or use what ever ports you want to use. The previous answer was asking if you were seeing TCP sessions in the WAE's. This can be seen by telneting to the WAE and issueing a "show tfo connection summary". Can you post the output of that command?

WAAS and 512 Deployment

Attach is the Visio as well as config for the India site. The Visio has 2 tabs (POC-WAAS and Proposed-WAAS). The POC (Proof of Concept) tab does not have the spare 3660 installed yet but I plan to do that soon. The "Proposed WAAS" is where we would want to be. However, my question will most likely address POC tab with the preparation to move to the Proposed tab.
Current assumptions:
Since we have a Manager in India, we will be getting another Manager in Calif, If so, I would like to setup a Primary/Standby deployment for redundancy.
Questions:
1. For Calif Primary WAE, the visio shows a Management interface but do I need a management interface or is it better to go with a standby interface instead as well as use MHSRP?
2. Since we have a high speed link (4 Mb Internet for VPN in POC but 10mb WAN for proposed), should we tune the buffers to the max? If so how?
3. Is this a recommend design for California? for India?
4. Is my configs a recommend configs for California 3660 in POC? If so, what do I need to change in 3825 in Proposed?

Zach
After reading the SRND, I believe the best design is to move the 512 to the Cores. Please see the updated Visio and planned configs. Here's my updated requirements:
1. Calif is hub
2. All traffic to India (10.2/10.26) should go through the VPN tunnel through (ASA5520)
3. All traffic to 10.3 and 10.5 should go through WAN via (R-Voice2)
4. Latency to India is btwn 280 to 340msec and BW is 2mb. Do I also need to be concern with the BDP, L2 redirect(forwarding), and Mask assignments?
TIA

WAAS and SSA Baan ERP

Hi all,
Anybody how have setup Cisco WAAS and ERP application BAAN?
I am interesting to setup a full optimization for ERP Baan.
Jan

Hi all,
We found the problem.
TCP/512 was in Classifier Unix-Remote-Execution and this Classifier was in pt.
Jan

WAAS and Checkpoint compatibility.

Similar Messages

Maybe you are looking for