Create a Post
Showing results for 
Search instead for 
Did you mean: 

ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

There is a Check Point cluster. Two 5200 series appliances.

Three Internet services connected to the cluster, from the same ISP. They see three IP addresses (each cluster's Internet address for each link) with the same MAC address (checkpoint cluster's virtual mac). That causes their system to activate an antispoofing alert and it periodically blocks the traffic.

Is there any way to set and independant VMACs?



Best Regards.

3 Replies

I know many people don't want to hear this but with VRRP you can choose for Extended VMAC, which is a deviate of the IP address and will be different for each interface.

Regards, Maarten

Thanks. We finally disabled vmac option. And solved our problem.


Champion Champion

When employing ClusterXL HA, the "use VMAC" option is unchecked by default and my opinion is that it should be left that way if possible.  Failovers will utilize the Gratuitous ARP mechanism when the VMAC box is unchecked, and that will usually work just fine in most networks.  However if "slow" or incomplete failovers for all NAT addresses are encountered, VMAC can be enabled but it may honk of the switching infrastructure (and STP) in various ways as described above.  At a minimum, make sure portfast is configured on the firewall's switchports if you plan to enable VMAC...

Second Edition of my "Max Power" Firewall Book
Now Available at

Gateway Performance Optimization R81.20 Course
now available at


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events