No VMAC address on cluster interface

[FortiFan]

Hi Everyone

I've created a new interface with the Cluster Network Type in a ClusterXL environment, but the virtual IP doesn't have a MAC address, so the clients connected to that network can't talk to anything outside of their VLAN, as the virtual IP is their standard gateway. They can however reach the member IP's that are configured on the two cluster members. 

I've run the command "cphaprob -a if" on the CLI and I don't see the interface that I created there.

I've created the interfaces on the two appliances on the gaia Web GUI and then created the interface for the virtual IP on the SmartConsole, and then I installed a policy on the device. 

I hope my post makes sense, as it's the first time in my career working with Checkpoint.

Can someone guide me a little on how to find out what I did wrong? 

Thanks. 

[Bob_Zimmerman]

First, a note. Check Point clustering doesn't involve virtual MAC addresses by default. The VIPs resolve to the real MAC address of the active member's interface. You can enable a shared virtual MAC by opening your cluster object, going to "ClusterXL and VRRP", and checking the box "Use Virtual MAC". With the way Check Point's clustering works, this normally is not necessary.

The fact the interface doesn't show up in 'cphaprob -a if' means something is wrong with the interface config. It sounds like you've taken the right steps to build the cluster interface, but I suspect the interface name doesn't match the interfaces on the firewall. In SmartConsole, open your cluster object, go to "Network Management", open the cluster interface you made, and go to the Advanced section. Look at "Interfaces Names" at the bottom. The name there needs to match the name of the interface as seen on the firewall command line. I believe it's even case-sensitive.

[FortiFan]

Thank you for your reply. Everything looked fine when another colleague and I looked at it, so I don't really know what I did wrong. I've deleted all the interfaces and created them again and it works now.

What I've not mentioned that could've interferred is that I've configured a DHCP Relay on member interfaces and instead of leaving the primary interface blank, I've put the IP address of the interface in the field. I've deleted it now and it says Primary Address (automatic) and everything works as expected.