CSA MC 5.x Redundancy

[jsteffensen]

Hi Everyone

We would like to use the following CSA comfiguration:

+ Clients inside network

- "One rule set"

- Detection of "inside location" done by verifying connection to CSA MC.

+ Clients Outside network

- "Deny all Network Traffick"

- applied when no connection to the CSA MC can be verified.

So this creates a small problem: What happens when CSA MC crashes, fails or is not available?

= No network access even when the client is connected to inside network = DoS = huge problem...

We need redundancy!

But i cannof find any information about creating a redundant setup.

Does anyone have experience?

Best Regards

Jarle

[j-block]

Try to capture the "icmp" debug log messages on the PIX when trying to ping from the host inside the PIX that had problem

getting out to another device outside the PIX.

A copy of the "ipconfig /all" and the "arp -a" output on the PC that is having problem connecting to the outside world

from the inside network and look for the issue.