VMAC disadvantages

[Boriska]

Hello,

The manual says that:
VMAC minimizes possible traffic outages, during a failover. In addition, G-ARPs for NAT’d IP addresses are no longer needed.
VMAC failover time is shorter than a failover that involves a physical MAC address.

If it's so good, why disabled by default?
What are the disadvantages of VMAC?

Thanks.

[G_W_Albrecht]

Did you read the explanations here already: sk50840: How to enable ClusterXL Virtual MAC (VMAC) mode

[Boriska]

Yes, but didn't find there answer for my question, about disadvantages.
Should I enable VMAC on every R80 ClusterXL HA? Or why I shouldn't?

[G_W_Albrecht]

Part (1) Overview explains why it can be usefull to enable it - but most times it is just not needed and therefore not on by default.

[Tobias_Moritz]

I understand your questions and I'm also not aware of any disadavantages. Yes, its not enabled by default, but we enable it on any Cluster XL HA Cluster.

Does anyone here knows disadavantages?

[Timothy_Hall]

This is covered in my book.  If you don't have portfast enabled on all switchports where the clustered firewalls are attached, use of a VMAC can sometimes cause STP issues where upon failover STP blocks the ports for 10-12 seconds back into Listening & Learning mode.   This is due to the same unicast MAC address briefly appearing on two switchports at the same time, which can be perceived by STP as a bridging loop.  This causes what I term a "slow" failover where all traffic comes to a screeching halt for about 10 seconds upon failover then suddenly starts working through the newly-active member.  On Cisco devices the involved switchports will glow amber during the "screech".   Portfast is NOT the same as disabling STP completely which you should NEVER do. 

Bottom line: Use the default G-ARP unless you experience slow or incomplete failovers (especially for plucked NAT addresses), then try VMAC but be sure to set portfast.