clusterxl vmac and proxy arp

[Dmitry_Barantse]

Hi team.

I have a question about clusterxl vmac option and nat with proxy arp.
What mac should be in proxy arp configuration for manual and automatic static nat?
I think that in both cases should be a virtual mac.
I'm I right?

[PhoneBoy]

Automatic Static NAT should be handled automatically (i.e. you don't need to add any proxy arp) unless you've disabled Automatic ARP configuration:

For Manual NAT rules you would use the cluster VMAC.

[Dmitry_Barantse]

Automatic ARP would be created with cluster virtual mac, isn't it?

[PhoneBoy]

Yes

[Robert_M_Nubile]

Hi Sir,

I believe that it should be configured using Virtual Mac Address but I opened a ticket with TAC and they told me that it must be configured using Physical Mac Address.

Are you that the Proxy ARP must be set using Virtual MAC Address?

Kind regards,

[Timothy_Hall]

Also keep in mind that on an R80.10+ gateway you can enable automatic handling of Proxy ARP for manual NAT rules and not have to worry about what MAC address it is:

sk114395: Automatic creation of Proxy ARP for Manual NAT rules on Security Gateway R80.10

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

[Martin_Raska]

Yes, but it's only for source NAT, so it's not usable for scenario, the connection from the Internet to public IP, which is not configured on any CP interfaces and I need to do DNAT from the public to private towards inside of my web server with 10.1.1.1.

[GG27]

I assume your clusterXL configuration is with Virtual Mac

In this case in the proxy arp configuration you have to create entries where the MAC is the virtual as well.

By CLI on the gateway, you can run "cphaprob -a if" and next to each virtual IP you see the virtual MAC set.

In case you won't use virtual MAC, the CLI command output won't show any MAC because you will use the physical MAC for the VIP.

in this last scenario in the proxy arp you have to configure the physical mac related of interface where Manual NAT is applied and the MAC on the other cluster member will be different than the other one.

[Maarten_Sjouw]

Do keep in mind that in cluster configs using the real-ip part of the statement needs to contain the real IP of the member for that interface.

Also you can see all advertised proxy arp's by using the 'fw ctl arp' command.