Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Boriska
Explorer

VMAC disadvantages

Hello,

The manual says that:
VMAC minimizes possible traffic outages, during a failover. In addition, G-ARPs for NAT’d IP addresses are no longer needed.
VMAC failover time is shorter than a failover that involves a physical MAC address.

If it's so good, why disabled by default?
What are the disadvantages of VMAC?

Thanks.

0 Kudos
5 Replies
G_W_Albrecht
Champion
Champion

Did you read the explanations here already: sk50840: How to enable ClusterXL Virtual MAC (VMAC) mode

0 Kudos
Boriska
Explorer

Yes, but didn't find there answer for my question, about disadvantages.
Should I enable VMAC on every R80 ClusterXL HA? Or why I shouldn't?

0 Kudos
G_W_Albrecht
Champion
Champion

Part (1) Overview explains why it can be usefull to enable it - but most times it is just not needed and therefore not on by default.

0 Kudos
Tobias_Moritz
Advisor

I understand your questions and I'm also not aware of any disadavantages. Yes, its not enabled by default, but we enable it on any Cluster XL HA Cluster.

Does anyone here knows disadavantages?

0 Kudos
Timothy_Hall
Champion
Champion

This is covered in my book.  If you don't have portfast enabled on all switchports where the clustered firewalls are attached, use of a VMAC can sometimes cause STP issues where upon failover STP blocks the ports for 10-12 seconds back into Listening & Learning mode.   This is due to the same unicast MAC address briefly appearing on two switchports at the same time, which can be perceived by STP as a bridging loop.  This causes what I term a "slow" failover where all traffic comes to a screeching halt for about 10 seconds upon failover then suddenly starts working through the newly-active member.  On Cisco devices the involved switchports will glow amber during the "screech".   Portfast is NOT the same as disabling STP completely which you should NEVER do. 

Bottom line: Use the default G-ARP unless you experience slow or incomplete failovers (especially for plucked NAT addresses), then try VMAC but be sure to set portfast.

"Max Capture: Know Your Packets" Video Series
now available at http://www.maxpowerfirewalls.com