Configure HA whis alias interface

[misha-kr]

Hi,

We tries to configure ClusterXL HA New Mode and has some issues with virtual interfaces. Cluster has real interfaces and some real interfaces have additional (alias) interfaces.
For example:
eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:07:e9:1a:6e:a8 brd ff:ff:ff:ff:ff:ff
inet 192.168.60.4/28 brd 192.168.60.15 scope global eth1
inet X.X.15.225/28 brd X.X.15.239 scope global eth1:2
eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:07:e9:1a:6d:d7 brd ff:ff:ff:ff:ff:ff
inet Y.Y.68.35/28 brd Y.Y.68.47 scope global eth2
inet 192.168.60.203/29 brd 192.168.60.207 scope global eth2:1


We configure cluster object and add all real and alias interfaces to topology. Install test policy (Any Any Accept). After that we try to test connections on different IP addresses of ClusterXL. For pinging we use test PC from same physical network.

Example
Cluster IP:
eth2
Real IP: Y.Y.68.35/28
Virtual IP: Y.Y.68.33/28
eth2:1
Real alias IP: 192.168.60.203/29
Virtual alias IP: 192.168.60.201/29

Test PC:

Y.Y.68.34/28
192.168.60.202/29

If we try to PING address of virtual IP cluster (Y.Y.68.33)– PING is ok. If we try to PING address of virtual alias IP cluster (192.168.60.201) – PING is fault. We thing that it happened because Cluster doesn’t return MAC address of virtual alias IP: 192.168.60.201/29.

Example TCPDump from cluster:
[root@fw root]# tcpdump -i eth2
tcpdump: listening on eth2
15:08:01.542711 arp who-has 192.168.60.201 (Broadcast) tell 192.168.60.202
15:08:02.542592 arp who-has 192.168.60.201 (Broadcast) tell 192.168.60.202
15:08:03.542721 arp who-has 192.168.60.201 (Broadcast) tell 192.168.60.202
15:08:04.542726 arp who-has 192.168.60.201 (Broadcast) tell 192.168.60.202
15:08:05.542855 arp who-has 192.168.60.201 (Broadcast) tell 192.168.60.202

Whether can ClusterXL work with alias interfaces?


P.S.
OS Linux RedHat 7.3

[dbedit]

There is a platform limitation on this feature. It is supported on Red Hat 7.3, SecurePlatform FP3 and Solaris 8 (32 bit/64 bit) with GigaSwift ethernet adapter. It works on Red Hat 7.2 and VLAN patch as well, but since it requires private Linux kernel compilation, it is not supported by Check Point.