cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

There is a Check Point cluster. Two 5200 series appliances.

Three Internet services connected to the cluster, from the same ISP. They see three IP addresses (each cluster's Internet address for each link) with the same MAC address (checkpoint cluster's virtual mac). That causes their system to activate an antispoofing alert and it periodically blocks the traffic.

Is there any way to set and independant VMACs?

 

Thanks 

Best Regards.

3 Replies

Re: ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

I know many people don't want to hear this but with VRRP you can choose for Extended VMAC, which is a deviate of the IP address and will be different for each interface.

Regards, Maarten

Re: ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

Thanks. We finally disabled vmac option. And solved our problem.

Regards

Re: ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

When employing ClusterXL HA, the "use VMAC" option is unchecked by default and my opinion is that it should be left that way if possible.  Failovers will utilize the Gratuitous ARP mechanism when the VMAC box is unchecked, and that will usually work just fine in most networks.  However if "slow" or incomplete failovers for all NAT addresses are encountered, VMAC can be enabled but it may honk of the switching infrastructure (and STP) in various ways as described above.  At a minimum, make sure portfast is configured on the firewall's switchports if you plan to enable VMAC...

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com