Alexander Wilke

VMAC Mode on R80.10

Discussion created by Alexander Wilke on Feb 10, 2017
Latest reply on Aug 15, 2018 by Dameon Welch Abernathy


Hi,

what do you think about the fact that R80.10 Gateways in VMAC Mode (ClusterXL, High Availability, Active/Standby) is only publishing its VMAC to clients for ingress traffic but then for egress traffic the Gateway will always use its physical MAC address and not the VMAC?

 

So clients address the firewall using the VMAC of the firewall but all traffic outgoing from the firewall to clients/servers has the physical MAC address as source-address. So it is a kind of "asynchroneous MAC address routing" - clients sends traffic to VMAC, firewalls sends traffic with physical MAC.

 

So is VMAC mode really what it should or should it better be named "VMAC lite" ?

What do you think is the reason for not using real "VMAC" for all kind of traffic like e.g. Cisco is doing it with HSRP? Performance issues? Bad internal design?

 

Regards

Outcomes