> Source: [sk40800](https://support.checkpoint.com/results/sk/sk40800)

# sk40800 - Firewall-1 does not distribute among ACE servers as per defined priorities.

| Property | Value |
|----------|-------|
| Solution ID | sk40800 |
| Date Created | 2009-04-14 |
| Last Modified | 2020-08-23 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- This resolution documents a situation where Firewall-1 is an ACE agent, but it does not distribute priorities amongst ACE servers defined in its sdopts.rec file.  

Normally ACE 5.x agents store server status data in the sdstatus.12 file which is an encrypted bookkeeping file for automatic load balancing. For each authentication, the Agent reads the file. The information on each server's response time is used to create a weighted index of servers. The Agent will randomly pick a server from this list, with the fastest server being more likely to be chosen than the slower servers.{#SPAN24686558}

To assign manual priorities to your ACE servers one creates a sdopts.rec file. The sdopts.rec which is placed in the /var/ace directory contains IP addresses of various ACE servers in the "realm" and their associated priorities for load balancing authentication requests.

## Solution

In this particular situation the sdopts.rec file was not being invoked by Firewall-1 because of the presence ofthe sdstatus.12 which is also in the /var/ace directory. The sdstatus.12 file takes precedence. Removing the sdstatus.12 file made the sdopts.rec take effect.

Additionally please check the format of the sdopts.rec file. Another reason a sdopts.rec file may not take effect is if there is a space between the IP address of the ACE server its priority.

Below is a sample sdopts.rec file.

CLIENT_IP=x.x.x.x  

USESERVER=172.16.1.1,10  

USESERVER=10.10.1.2,5  

USESERVER=10.132.15.3,1  

;PRIORITY: 10-2=RANDOMIZED SELECTION - PRIORITY 10 RECEIVES   

;ABOUT 24 TIMES MORE REQUESTS THAN PRIORITY 2,  

;1=USE ON FAILOVER ONLY, 0=IGNORE

* Make sure that you do not have empty lines at the end of the configuration file (can make the configuration file redundant).

For further information on configuring the ACE Server please contact your RSA support.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content