Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Conntrackd claims to need a dedicated link for some reason.

My setup is basically: 2x1GBe channel bonded into bond0 on each failover firewall.

Seeing as conntrackd claims to need a dedicated link I thought I could get away with putting it into a VLAN. The VLAN works fine, but conntrackd doesn't start.

[Tue Nov 20 11:12:50 2012] (pid=1704) [ERROR] no dedicated links available!

Now if I just specify bond0 it works. But this doesn't seem to be a recommended configuration. Will this cause me any potential problems?

share|improve this question
    
Do you really care about why? Should you be asking about alternatives? –  Zoredache Nov 20 '12 at 0:26
    
True. I wasn't aware of any alternatives to conntrackd or alternaive configurations that I could get away with. I just want it to work at the end of the day and not be forced to giving up a link in the bond. –  Matt Nov 20 '12 at 0:27
    
Well I mean alternatives to a dedicated link. Your question seems to be asking us to explain what the developers were thinking. I suspect you don't really care, and just want to make something work. –  Zoredache Nov 20 '12 at 0:29
    
THanks, yes let me alter the question slightly –  Matt Nov 20 '12 at 0:29
    
Part of the logic of a firewall is that you don't trust the networks it's connected to. So without a dedicated link that you did trust, how would the firewalls securely exchange state information? –  David Schwartz Nov 20 '12 at 0:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.