topic Re: CCP packets sent to network address instead of broadcast address in Firewall and Security Management

CCP packets sent to network address instead of broadcast address

TomShanti — Thu, 24 Oct 2019 15:22:02 GMT

Hi,

my GW cluster is R80.10. I captured the following CCP traffic on one interface:

Network: 192.168.60.64/27

VIP: 192.168.60.65/27

Member1: 192.168.60.66/27

Member2: 192.168.60.67/27

Packets captured:

Source: 0.0.0.0 -> Destination: 192.168.60.64 - Port UDP8116

From all SKs and infos I read about CCP the packets should go to the broadcast IP 192.168.60.95, right ?

Regards Tom

Re: CCP packets sent to network address instead of broadcast address

HeikoAnkenbrand — Thu, 24 Oct 2019 16:44:16 GMT

Hi @TomShanti

That's all correct.

With Broadcast CCP the network IP address is always used as destination. In your case 192.168.60.64. It's not layer 3 broadcast, it's layer 2 broadcast.

Here only the broadcast MAC ff:ff:ff:ff:ff:ff is used.

Here I describe the important broadcast and multicast CCP parameters in a picture. More read here.

R80.x - cheat sheet - ClusterXL

Re: CCP packets sent to network address instead of broadcast address

TomShanti — Thu, 31 Oct 2019 16:20:21 GMT

Hi Heiko,

still not sure if this is correct 🙂

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk115142

Cause

Check Point CCP packets are not able to pass through the switch when CCP is working in multicast mode (by default, the destination IP address of CCP packets is broadcast IP address for the relevant subnet).

All my readings say "broadcast IP" not "network IP".

Regards

Tom