Cluster Load sharing issue

[VIKAS_SINGH]

Hi,

I am using R81.20 with JHF-take 65 for my FW1 and FW2. I made cluster. 

While enabling the Load balance , I am not able to reach global dns 8.8.8.8 from both Gateway.

on HA we are able to reach global dns.

Attached some snap for reference.

Cphaprob stat output

Ping global dns

[PhoneBoy]

What do you see with a tcpdump when trying this?

[VIKAS_SINGH]

i hvnt taken tcpdump , will post on Monday .

[the_rock]

We definitely need more info. As Phoneboy advised, run tcpdump, fw monitor, try ip r g 8.8.8.8. Can you also send us output of route command from expert mode?

What does traceroute show? Network unreachable is super generic error that can mean multiple things. Could be interface issue, default gateway problem, route.

Best,

Andy

[Chris_Atkinson]

What switches do you have and how is the multicast/IGMP/arp config?

See also sk44898

[the_rock]

Valid point Chris.

[VIKAS_SINGH]

we are using Aruba core switches 8360V2 and we have configure MLAG. all VLAN configured on Core switches .

Gateway side we hv done the Bond configuration on both GW.

I hv attached my setup diagram below , also i forget to mention that i am using Ipsec blade and mobile blade 

[the_rock]

I have bunch of colleagues who deal with Aruba constantly (I personally dont as much), but I always hear them talk about igmp snooping. Maybe something you can verify if its enabled. Obviously, if you have multicast traffic on your network, that needs to be enabled, otherwise, probably not.

Andy

[Chris_Atkinson]

I'm not sure the bonds are so relevant here but you can check to ensure the hashing mode aligns.

Per the sk article I referenced above Load-sharing cluster mode isn't compatible with all vendors switches, you may need to implement some changes.

[VIKAS_SINGH]

Hi, 

I hv one query ,i hv gone through some documents from checkpoint that Load sharing will not work when Ipsec and Mobile blade enable...is it true? or ?

[Chris_Atkinson]

 Please see sk101539 for more information, some limitations are version specific.

Also worth mentioning to keep an eye out for  ElasticXL with R82 in terms of load-sharing capabilities.

[the_rock]

Hey @VIKAS_SINGH 

Were you able to get any traction on this issue?

Best,

Andy

[VIKAS_SINGH]

HI,

Its running setup so not able to do any troubleshooting , i will get time on weekend only . will keep you posted.

[Timothy_Hall]

Most L3 routers (not L2 switches) will refuse to cache a multicast MAC address received in an ARP reply so you will probably need to hardcode this on all L3 devices surrounding the gateway.

For your L2 switches, not all switches will handle multicast MAC addresses correctly, and will not consistently forward traffic bound for a multicast MAC to all the proper ports.  Once again, hardcoding the multicast MACs at the switch level may be required.  To summarize:

MULTICAST MACs = HARDCODING PAIN & SUFFERING

When taking your tcpdumps, make sure to include the -e option so you can see the Layer 2 MAC addresses.