Quantum Spark is forwarding traffic to eth0 interface

[JDCasCruz]

Hello team,

I have recently been checking some traffic on my Quantum Spark (SMB) #, then I noticed that the traffic comes in on the WAN interface, then it is forwarded to the LAN interface, but then it seems to be forwarded again, but to the eth0 interfa
When the traffic is outgoing, this behavior is not evident. I attach a screenshot where you can see the above.
Why is the traffic being forwarded to the eth0 interface, is this the expected behavior? and finally, what are the eth0 and eth1 interfaces used for?
Please help me to understand this behavior.

Regards.

[AkosBakos]

Hi @JDCasCruz 

fw monitor shows tha same?

Try this: fw monitor -F "172.16.27.102,0,0,0,0"

Do you see the "plus" packet on eth0?

Ákos

[JDCasCruz]

Hello @AkosBakos ,
When I use fw monitor it seems that the traffic goes from the WAN to the LAN, as you can see in the picture. But there is a lot of traffic when I check ifconfig or cpview, which is a bit strange.

Regards.

[AkosBakos]

Yes, but the offical packet capture tool is fw monitor. 

Maybe, the others are misleading in this scenario (because of the traffic is accelerated etc...) Unfortunately I don't have a SPARk appliance yet, but I am really curious now.

Otherwise which port is the eth0 on a Spark appliance? The ports are named like this LAN1-8, MGMT SYNC, aren't they?

But wait: the LAN7 and eth0 have the same MAC!

...and the fw monitor shows the "normal" packet flow.

The SPARK experts will answer it soon. @G_W_Albrecht ?

Akos

[the_rock]

I noticed that as well when I looked at it. I tagged Gunther, lets see if he can help 🙂

Andy

@G_W_Albrecht 

[Chris_Atkinson]

sk166552 explains the mac-address and likely the other interface reference to an extent.

"All LAN ports/switches share the same MAC address as they are connected via one internal port to the CPU."

[Chris_Atkinson]

Could you share the firmware version/build used with this appliance so we can check it further.

Is this a cluster or do you have any bridge configured?

[JDCasCruz]

This is a cluster XL, actually is running R81.10.10 945 and it is centrally managed.
There is nothing configured in bridge mode.

Thanks for checking @Chris_Atkinson 

[the_rock]

I would do what @AkosBakos suggested as well.