Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Dmitry_Barantse
Participant
Participant

clusterxl vmac and proxy arp

Hi team.

I have a question about clusterxl vmac option and nat with proxy arp.
What mac should be in proxy arp configuration for manual and automatic static nat?
I think that in both cases should be a virtual mac.
I'm I right?

0 Kudos
8 Replies
PhoneBoy
Admin
Admin

Automatic Static NAT should be handled automatically (i.e. you don't need to add any proxy arp) unless you've disabled Automatic ARP configuration:

For Manual NAT rules you would use the cluster VMAC.

0 Kudos
Dmitry_Barantse
Participant
Participant

Automatic ARP would be created with cluster virtual mac, isn't it?

0 Kudos
PhoneBoy
Admin
Admin

Yes

0 Kudos
Robert_M_Nubile
Explorer
Explorer

Hi Sir,

I believe that it should be configured using Virtual Mac Address but I opened a ticket with TAC and they told me that it must be configured using Physical Mac Address.

Are you that the Proxy ARP must be set using Virtual MAC Address?

Kind regards,

0 Kudos
Timothy_Hall
Legend Legend
Legend

Also keep in mind that on an R80.10+ gateway you can enable automatic handling of Proxy ARP for manual NAT rules and not have to worry about what MAC address it is:

sk114395: Automatic creation of Proxy ARP for Manual NAT rules on Security Gateway R80.10

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
Martin_Raska
Advisor
Advisor

Yes, but it's only for source NAT, so it's not usable for scenario, the connection from the Internet to public IP, which is not configured on any CP interfaces and I need to do DNAT from the public to private towards inside of my web server with 10.1.1.1.

0 Kudos
GG27
Contributor

I assume your clusterXL configuration is with Virtual Mac

In this case in the proxy arp configuration you have to create entries where the MAC is the virtual as well.

By CLI on the gateway, you can run "cphaprob -a if" and next to each virtual IP you see the virtual MAC set.

In case you won't use virtual MAC, the CLI command output won't show any MAC because you will use the physical MAC for the VIP.

in this last scenario in the proxy arp you have to configure the physical mac related of interface where Manual NAT is applied and the MAC on the other cluster member will be different than the other one.

0 Kudos
Maarten_Sjouw
Champion
Champion

Do keep in mind that in cluster configs using the real-ip part of the statement needs to contain the real IP of the member for that interface.

Also you can see all advertised proxy arp's by using the 'fw ctl arp' command.

Regards, Maarten
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events