topic Re: permanent mac address change for bond interface in Hyperscale Firewall (Maestro)

permanent mac address change for bond interface

Goldie — Thu, 01 Feb 2024 10:39:02 GMT

Customer is doing migration from CHKP cluster (VMAC mode) to Maestro R81.20_41.

There is a need to clone VMAC mac to bond mac (customer uses huge amount of virtual machines which have problems with mac refresh for def. gw which is mentioned CHKP).

Bond mac address was changed using modified mac address of first interface during bond creation. But it is not stable and permanent solution - during gateway initialization tasks/reboots/clusterXL_admin up info about bond mac clone is lost or inconsistent between members.

How to achieve this task to be permanent and stable ?

Re: permanent mac address change for bond interface

emmap — Mon, 05 Feb 2024 04:14:17 GMT

The MAC that Maestro uses for its ports is a VMAC that is calculated from various sources, including the port number and a unique ID for each security group, which presumably is calculated on bootup and overrides any manual MAC changes that have been made. I don't know that it would be supported to customise the MACs being used here.

Re: permanent mac address change for bond interface

BartekS — Mon, 05 Feb 2024 08:19:29 GMT

Hi emmap,

the same problem applies to my environment. Could you check if Chkp has a supported solution similar to the one Goldie describes?

Re: permanent mac address change for bond interface

emmap — Tue, 06 Feb 2024 05:13:27 GMT

I can find no supported way to edit the entire MAC address for a Maestro uplink, I suggest you engage your local CP SE and submit an RFE.