topic ClusterXL- switch CISCO reports Packet received with invalid source MAC address (00:00:00:00:00:00) in Spark Firewall (SMB)

ClusterXL- switch CISCO reports Packet received with invalid source MAC address (00:00:00:00:00:00)

JDCasCruz — Tue, 21 Nov 2023 17:38:04 GMT

Hello team,

We have a ClusterXL with two 1800 appliances with R81.10.08, in High Availability. Today the switching team informs us that from the interface connected to our WAN interface the error is generated:

Packet received with invalid source MAC address (00:00:00:00:00:00:00:00:00).

In the WAN interface I can see no errors, no drops, the cluster has not switched in those hours, and there is no evidence of high resource consumption.

In the switch we can see two entries in this port, the first one is the physical MAC of our WAN interface, and the second one is the VMAC address.

How can I verify what is happening with the interface?

Thanks in advance and let me know if you need more information.

Re: ClusterXL- switch CISCO reports Packet received with invalid source MAC address (00:00:00:00:00:

PhoneBoy — Tue, 21 Nov 2023 20:45:34 GMT

Have you used tcpdump -e to verify the MAC address of the packets originating from that interface are correct?

Re: ClusterXL- switch CISCO reports Packet received with invalid source MAC address (00:00:00:00:00:

JDCasCruz — Wed, 22 Nov 2023 14:02:02 GMT

I used tcpdump, but the problem isn't happenning all time. But in the cisco switch it relates the port connected to the firewall. What else could I do to validate the problem?. Thank you.

Re: ClusterXL- switch CISCO reports Packet received with invalid source MAC address (00:00:00:00:00:

JDCasCruz — Tue, 28 Nov 2023 23:23:30 GMT

Hello team,
Today the problem happened again, and I found one thing in common with the first time it happened. In both cases I was creating a static route in the webUI.

cat /var/log/routed_messages

FIRST TIME:
FW-2 (ACTIVE):
Nov 21 10:25:29.929134 [routed] NOTICE: task_reconfigure re-initializing from /etc/routed0.conf.
Nov 21 10:25:29.935715 [routed] NOTICE: Tracing to "/var/log/routed.log" suspended

SECOND TIME:
FW-1(ACTIVE):
Nov 28 15:55:28.622737 [routed] NOTICE: task_reconfigure re-initializing from /etc/routed0.conf
Nov 28 15:55:28.628394 [routed] NOTICE: Tracing to "/var/log/routed.log" suspended

Now, what can I do?

Re: ClusterXL- switch CISCO reports Packet received with invalid source MAC address (00:00:00:00:00:

PhoneBoy — Tue, 28 Nov 2023 23:50:32 GMT

Suggest engaging with the TAC: https://help.checkpoint.com