R81.10.07 and 08 - Centrally managed ClusterXL with Vmac : G-ARP issues

[KristofV]

We have upgraded some centrally managed spark clusters from R81.10.00 to R81.10.07 to activate SDwan and run into some serious stability issues. The problem seems to only be related to Vmac in ClusterXL.

It looks like internet lines are flapping, but by doing some troubleshooting, we see the reply traffic arriving in the standby firewall.For some reason, the standby firewall is sending  gratuitous ARP messages for the VIP IP addresses, sent out with the VMAC as source. This broadcast message will trigger a change in the mac table of the switch, and traffic for the VIP is put on the wire of the standby firewall.

TAC case is created and confirmed to be an issue, other customers have also seen this behavior. Disabling vmac solves the issue, shutting down the standby firewall also !

Be aware when upgrading to this version when you have VMAC enabled ! R81.10.00 does not have the issue.

[PhoneBoy]

Thanks for the heads up.

[KristofV · Accepted solution]

Problem is resolved in the latest R81.10.08 version. ( as from 1690 ) 

[Ted_Serreyn]

frustrated that this fix has been out here for a while with no code release or no SK listing issue.  Just had a customer POC hit this, would have been nice to have known.

[KristofV]

It also seems to be resolved and documented in the R81.10.10 release :

SMBGWY-6348

Firewall

When you enable Virtual MAC (VMAC) mode on a centrally managed cluster, the standby member sends GARP packets.