What is Magic MAC?

[Kumar]

Could you please explain me what is a magic MAC and how it was used in clustering and also explain clustering in detailed (MAC exchange)

[Kaspars_Zibarts]

Try this https://community.checkpoint.com/message/12542-re-why-is-the-cluster-id-field-missing-in-r8010-ftw there is a reference to SK to read up about magic MAC

[ED]

You can enjoy the reading of ClusterXL administration guide where everything is explained http://dl3.checkpoint.com/paid/63/6357d81e3b75b5a09a422d715c3b3d79/CP_R80.10_ClusterXL_AdminGuide.pd...

[MartijnElzenaar]

Mac Magic is a sort of identification mechanism of the clusterID's in CCP (a very generic answer). 

It is best to read sk25977 in order to get some understanding about it. All answers regarding your question are given there. It's a very good read to understand the underlying technology.

The whole ClusterXL mechanism is explained in the ATRG for ClusterXL which also covers Mac Magic a bit. 

Enjoy and I think this will really give you a very good overview of how things relate to each other. 

/Martijn

[Timothy_Hall]

Although not directly related to gateway performance, I've run into issues with this so many times that it did merit a mention in the second edition of my book:

The Magic MAC/Global Cluster ID

There is one situation you might see in a misconfigured cluster that is worth mentioning here however, as it can be so perplexing. When running the cphaprob stat command on all cluster members, both cluster members report they are the only cluster member present (i.e. the cluster members cannot “see” each other at all) and both of them also report they are “active”! How the heck can such a “split-brain” situation occur when setting up a new ClusterXL cluster?

This problem is related to the so-called “Magic MAC address” (yes that was its original name!), but it is now referred to as the “Cluster Global ID”. On an R77.30 firewall, this value is set during the Gaia web interface First Time Configuration Wizard dialog in the Cluster Global ID field:

The command cphaconf cluster_id set (Cluster ID Value) can also be used to set this value. For an R77.30 firewall, the Cluster Global ID should be manually set to an identical value on all members of the same cluster, but be a unique value for different clusters. Failure to configure a matching Global Cluster ID value on the two R77.30 cluster members will cause the split-brain situation mentioned above. On R77.30 and earlier firewalls the Global Cluster ID value can be checked on each of the cluster members with the cphaconf cluster_id get command.

There is good news about this situation though for R80.10+ gateway: a matching Global Cluster ID is now automatically calculated for all cluster members through a process called “Automatic MAC Magic”. This new feature is also designed to prevent conflicts with other existing firewall clusters on the same network. The status of this new feature (including the automatically calculated Global Cluster ID value) can be verified on an R80.10+ gateway with the cphaprob mmagic command. It can also be checked from a new ClusterXL-based screen of the cpview tool on an R80.10 gateway under “Advanced...ClusterXL”. This new “Automatic MAC Magic” feature is also backwards compatible with R77.30 gateways that had their Global Cluster IDs configured manually in earlier versions.

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

[JozkoMrkvicka]

Can we somehow bypass that "automatic MAC magic" for R80.10 ? To use "old style" global ID.

Anyway, I would like to know how this new feature on R80.10 works... I will install 4 new members at the same time in the same VLAN and I want to say that member A and D will be members of Cluster1 and members B and C members of Cluster2 ... how will this new feature know that I need such a configuration ? Based on first policy installation ?

[Kaspars_Zibarts]

It's all described in the SK https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

[Alsnator_C]

good explanation Tim as always!