ISP blocks traffic - Their anti-spoofing system - Same VMAC for 3 interfaces

[Diego_Javier_Me]

There is a Check Point cluster. Two 5200 series appliances.

Three Internet services connected to the cluster, from the same ISP. They see three IP addresses (each cluster's Internet address for each link) with the same MAC address (checkpoint cluster's virtual mac). That causes their system to activate an antispoofing alert and it periodically blocks the traffic.

Is there any way to set and independant VMACs?

Thanks 

Best Regards.

[Maarten_Sjouw]

I know many people don't want to hear this but with VRRP you can choose for Extended VMAC, which is a deviate of the IP address and will be different for each interface.

[Diego_Javier_Me]

Thanks. We finally disabled vmac option. And solved our problem.

Regards

[Timothy_Hall]

When employing ClusterXL HA, the "use VMAC" option is unchecked by default and my opinion is that it should be left that way if possible.  Failovers will utilize the Gratuitous ARP mechanism when the VMAC box is unchecked, and that will usually work just fine in most networks.  However if "slow" or incomplete failovers for all NAT addresses are encountered, VMAC can be enabled but it may honk of the switching infrastructure (and STP) in various ways as described above.  At a minimum, make sure portfast is configured on the firewall's switchports if you plan to enable VMAC...

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com