Checkpoint HA New Mode arp issue

[wiz4rd]

Hello,

I have some problems when a failover occurs with my cluster NGX R60 ClusterXL New Mode.


When the pivot node have a problem the other member (no-pivot) will be active and all the connections will go through it, but this is not transparent for the end users this seem a problem with gratuitous arp from checkpoint .

I'm under unicast mode so if the node A go down the node B will be active with the own mac-address but with the same virtual ip of node A.

Any ideas if a problem of firewall or switch or loadbalancer like radware ?

Thank you

[wiz4rd]

Hello,


if I use Tcpdump on Cluster Members if there is a failover I see the Gratuitous ARP sent, so this problem about arp refresh rate is on switchs / Load Balancer Appliances.

Thank you for the support

[JohnMH]

What make and model of switches?
John

[wiz4rd]

6500 Cisco + 4000

[hornsan]

Hi,

I have the same problem here. I am using ClusterXL New Mode as well. When i bring down the FW1, FW2 takes over, but the Internet connection failed. We also using Cisco 6500 series (4-ports layer 2 VLAN created for this external subnet). Accroding to CheckPoint, this mode is running on Unicast, we SHOULD NOT worry about the MULTICAST IGMP.

The same solution works well in Cisco 4500 series switch.

Any idea?? please help.