topic Re: MAC-Flapping on the same bond interface (active-standby) in Firewall and Security Management

MAC-Flapping on the same bond interface (active-standby)

andrewb — Wed, 17 May 2023 23:02:32 GMT

Hi,

What is the behavior of bond interface on an "active-standby" state?

I believe the "standby" state does not have any traffic flowing thru right?

We have an issue here after upgrading the 15600 to R81, the switch started reporting MAC-FLAP, when we checked it was coming from the same bond port of the firewall which is set to active standby.

When I did a wireshark i saw traffic on the standby port and the CPHA packet source mac-address they are using the same MAC-address

Do we expect the same mac-address on both ports when they are trying CPHA packet? When i checked a 16200 - it was using 00:00:00:00:01:00 , however the 15600 was using the physical MAC of the the other interface on the same bond

Thanks

Re: MAC-Flapping on the same bond interface (active-standby)

Chris_Atkinson — Wed, 17 May 2023 23:52:05 GMT

Is the 16200 also using active-standby bonds and what version & JHF by comparison?

Re: MAC-Flapping on the same bond interface (active-standby)

andrewb — Thu, 18 May 2023 00:05:18 GMT

Yes, the 16200 is running the same version R81 with same bond configuration (active-standby). The 15600 has the higher JHF

Re: MAC-Flapping on the same bond interface (active-standby)

the_rock — Thu, 18 May 2023 00:05:42 GMT

I know in the old days of CP, sometimes that would happen depending on whether virtual MAC option was checked under cluster object in smart console.

Andy

Re: MAC-Flapping on the same bond interface (active-standby)

andrewb — Thu, 18 May 2023 00:10:37 GMT

Yes, but it is just weird - the port is only on standby state, it does not goes up and down. It should just take over when the primary fails

Re: MAC-Flapping on the same bond interface (active-standby)

the_rock — Thu, 18 May 2023 00:30:43 GMT

Just to verify all, can you please send output of below commands on both members? Please blur out any sensitive info.

Andy

cphaprob roles

cphaprob state

cphaprob -i list

cphaprob -a if

cphaprob syncstat

Cheers,

Andy

Re: MAC-Flapping on the same bond interface (active-standby)

andrewb — Thu, 18 May 2023 01:33:50 GMT

Hi, ill try to capture, BTW this is VSX not normal firewall

Re: MAC-Flapping on the same bond interface (active-standby)

the_rock — Thu, 18 May 2023 01:36:45 GMT

I am pretty sure same commands would work on VSX as well.