topic Re: ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces in General Topics

ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

Diego_Javier_Me — Wed, 21 Nov 2018 19:04:40 GMT

There is a Check Point cluster. Two 5200 series appliances.

Three Internet services connected to the cluster, from the same ISP. They see three IP addresses (each cluster's Internet address for each link) with the same MAC address (checkpoint cluster's virtual mac). That causes their system to activate an antispoofing alert and it periodically blocks the traffic.

Is there any way to set and independant VMACs?

Thanks

Best Regards.

Re: ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

Maarten_Sjouw — Wed, 21 Nov 2018 21:32:26 GMT

I know many people don't want to hear this but with VRRP you can choose for Extended VMAC, which is a deviate of the IP address and will be different for each interface.

Re: ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

Diego_Javier_Me — Thu, 13 Dec 2018 16:33:56 GMT

Thanks. We finally disabled vmac option. And solved our problem.

Regards

Re: ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

Timothy_Hall — Fri, 14 Dec 2018 13:25:13 GMT

When employing ClusterXL HA, the "use VMAC" option is unchecked by default and my opinion is that it should be left that way if possible. Failovers will utilize the Gratuitous ARP mechanism when the VMAC box is unchecked, and that will usually work just fine in most networks. However if "slow" or incomplete failovers for all NAT addresses are encountered, VMAC can be enabled but it may honk of the switching infrastructure (and STP) in various ways as described above. At a minimum, make sure portfast is configured on the firewall's switchports if you plan to enable VMAC...

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com