Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
FedericoMeiners
Advisor

VSX Cluster + Bond + Proxy ARP: To VMAC or not to VMAC

Hello,

Hope you're doing well, recently I had to design an architecture that supports a VSX cluster of 2 gateways( active/passive) in R80.20 or R80.30

We have bonded interfaces and manual NAT entries in many VS. When I started researching about Proxy ARP in VSX I found a blog entry from @_Val_ about how to approach this design:

http://checkpoint-master-architect.blogspot.com/2014/08/setting-proxy-arp-for-bonded-interface.html

Long story short, you have the following options:

  1. Create a Virtual Switch and attach the bond to that virtual device and setup the proxy ARP on the virtual link between the vswitch and the vsystem.
  2. Configure VMAC on VSX cluster and add Proxy ARP entries on that VMAC
  3. Let the bond as it is.

As stated in the blog post, solution 2 and 3 are more viable, my question is the following: ¿Which option is the recommended one?

From my point of view is always best to deploy as most default as possible, option 3 would be the best, also I had some issues with VMACs.

My concern is how Check Point handles the MAC of the bond interface, when you set it up one of the interface's MAC address is chosen and is used by the bond and the N interfaces. However it seems that there was a time when this MAC could change, reffer to SK111675:

"MAC address for Bond interface changes after reboot. This affects the Proxy ARP configuration if the client is manually configuring the Bond interface's MAC address in the Proxy ARP.

This problem was fixed. The fix is included in:

Check Point R80.10
Jumbo Hotfix Accumulator for R77.30 - since Take_210"

In theory it should be safe to just use de MAC of the bond.

Would be great to have your opinion on this matter, 

Thanks for reading,

Federico Meiners

____________
https://www.linkedin.com/in/federicomeiners/
0 Kudos
4 Replies
This widget could not be displayed.