ESP packets use ISP router MAC instead of ISP HSRP MAC

Robin_H — Wed, 26 Mar 2025 20:20:52 GMT

Hi!

I have several sites with an R81.10 cluster (active/standby), two switches and two ISP routers.

These routers are configured with HSRP.

When the ISP router sends packets, the source MAC is always the router MAC.

When the firewall is sending traffic to the internet, the HSRP MAC of the ISP router is used as a destination.

Exception: when the firewall is sending ESP packets with protocol "UDP (17)" (looks like the actual VPN data packets for Site2Site and Client2Site connections), then the MAC of the actual router is used as a destination.

Is this an expected behaviour or can it be influenced?

The issue with this is: In case of a router failure, the traffic will be send to a dead MAC.

And as we also have a site with ISP load-sharing, the traffic might be sent directly to the secondary router. If then the switch in the path is restarted, the VPN tunnels also suffer.

Thanks in advance for some insights!

EDIT: Through the support portal I now found this vpn r80.20 vsx - Check Point CheckMates, looks quite similar. Will look at it tomorrow, it didn´t come up in the Community website search.

topic ESP packets use ISP router MAC instead of ISP HSRP MAC in Firewall and Security Management

ESP packets use ISP router MAC instead of ISP HSRP MAC