topic Re: VMAC disadvantages in Firewall and Security Management

VMAC disadvantages

Boriska — Thu, 28 Jan 2021 11:32:33 GMT

Hello,

The manual says that:
VMAC minimizes possible traffic outages, during a failover. In addition, G-ARPs for NAT’d IP addresses are no longer needed.
VMAC failover time is shorter than a failover that involves a physical MAC address.

If it's so good, why disabled by default?
What are the disadvantages of VMAC?

Thanks.

Re: VMAC disadvantages

G_W_Albrecht — Thu, 28 Jan 2021 11:42:44 GMT

Did you read the explanations here already: sk50840: How to enable ClusterXL Virtual MAC (VMAC) mode

Re: VMAC disadvantages

Boriska — Thu, 28 Jan 2021 11:58:07 GMT

Yes, but didn't find there answer for my question, about disadvantages.
Should I enable VMAC on every R80 ClusterXL HA? Or why I shouldn't?

Re: VMAC disadvantages

G_W_Albrecht — Thu, 28 Jan 2021 13:03:15 GMT

Part (1) Overview explains why it can be usefull to enable it - but most times it is just not needed and therefore not on by default.

Re: VMAC disadvantages

Tobias_Moritz — Thu, 28 Jan 2021 13:39:29 GMT

I understand your questions and I'm also not aware of any disadavantages. Yes, its not enabled by default, but we enable it on any Cluster XL HA Cluster.

Does anyone here knows disadavantages?

Re: VMAC disadvantages

Timothy_Hall — Thu, 28 Jan 2021 14:29:03 GMT

This is covered in my book. If you don't have portfast enabled on all switchports where the clustered firewalls are attached, use of a VMAC can sometimes cause STP issues where upon failover STP blocks the ports for 10-12 seconds back into Listening & Learning mode. This is due to the same unicast MAC address briefly appearing on two switchports at the same time, which can be perceived by STP as a bridging loop. This causes what I term a "slow" failover where all traffic comes to a screeching halt for about 10 seconds upon failover then suddenly starts working through the newly-active member. On Cisco devices the involved switchports will glow amber during the "screech". Portfast is NOT the same as disabling STP completely which you should NEVER do.

Bottom line: Use the default G-ARP unless you experience slow or incomplete failovers (especially for plucked NAT addresses), then try VMAC but be sure to set portfast.