https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/192399#M9476 <P>We have upgraded some centrally managed spark clusters from R81.10.00 to R81.10.07 to activate SDwan and run into some serious stability issues. The problem seems to only be related to Vmac in ClusterXL.</P><P>It looks like internet lines are flapping, but by doing some troubleshooting, we see the reply traffic arriving in the standby firewall.For some reason, the standby firewall is sending&nbsp; gratuitous ARP messages for the VIP IP addresses, sent out with the VMAC as source. This broadcast message will trigger a change in the mac table of the switch, and traffic for the VIP is put on the wire of the standby firewall.</P><P>TAC case is created and confirmed to be an issue, other customers have also seen this behavior. Disabling vmac solves the issue, shutting down the standby firewall also !</P><P>Be aware when upgrading to this version when you have VMAC enabled ! R81.10.00 does not have the issue.</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 12 Sep 2023 12:08:18 GMT K_R_V 2023-09-12T12:08:18Z https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/192399#M9476 <P>We have upgraded some centrally managed spark clusters from R81.10.00 to R81.10.07 to activate SDwan and run into some serious stability issues. The problem seems to only be related to Vmac in ClusterXL.</P><P>It looks like internet lines are flapping, but by doing some troubleshooting, we see the reply traffic arriving in the standby firewall.For some reason, the standby firewall is sending&nbsp; gratuitous ARP messages for the VIP IP addresses, sent out with the VMAC as source. This broadcast message will trigger a change in the mac table of the switch, and traffic for the VIP is put on the wire of the standby firewall.</P><P>TAC case is created and confirmed to be an issue, other customers have also seen this behavior. Disabling vmac solves the issue, shutting down the standby firewall also !</P><P>Be aware when upgrading to this version when you have VMAC enabled ! R81.10.00 does not have the issue.</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 12 Sep 2023 12:08:18 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/192399#M9476 K_R_V 2023-09-12T12:08:18Z https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/192440#M9482 <P>Thanks for the heads up.</P> Tue, 12 Sep 2023 15:49:31 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/192440#M9482 PhoneBoy 2023-09-12T15:49:31Z https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/202062#M10068 <P>Problem is resolved in the latest R81.10.08 version. ( as from 1690 )&nbsp;</P> Tue, 30 Jan 2024 08:35:41 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/202062#M10068 K_R_V 2024-01-30T08:35:41Z https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/204989#M10218 <P>frustrated that this fix has been out here for a while with no code release or no SK listing issue.&nbsp; Just had a customer POC hit this, would have been nice to have known.</P> Sun, 04 Feb 2024 18:43:07 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/204989#M10218 Ted_Serreyn 2024-02-04T18:43:07Z https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/207372#M10310 <P>It also seems to be resolved and documented in the R81.10.10 release :</P><TABLE border="1" width="100%" cellspacing="2" cellpadding="4"><TBODY><TR><TD>SMBGWY-6348</TD><TD>Firewall</TD><TD>When you enable Virtual MAC (VMAC) mode on a centrally managed cluster, the standby member sends GARP packets.</TD></TR></TBODY></TABLE> Wed, 28 Feb 2024 15:40:41 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/R81-10-07-and-08-Centrally-managed-ClusterXL-with-Vmac-G-ARP/m-p/207372#M10310 K_R_V 2024-02-28T15:40:41Z