This section applies to all ClusterXL modes, both High Availability and Load Sharing.
Cluster Members communicate with each other using the Cluster Control Protocol (CCP). CCP packets are distinguished from ordinary network traffic by giving CCP packets a unique source MAC address.
Default value of fifth byte |
Purpose |
---|---|
0xfe |
CCP traffic |
0xfd |
Forwarding layer traffic |
When more than one cluster is connected to the same VLAN, if CCP and Forwarding Layer traffic uses Multicast MAC address for the destination, this traffic reaches only the intended cluster.
If the Broadcast MAC address is used for Destination for CCP and for Forwarding Layer traffic (and in certain other cases), cluster traffic intended for one cluster is seen by all connected clusters. If this traffic is processed by the wrong cluster, it will cause communication problems.
To resolve the issue, change the source MAC address (MAC magic ID) of the cluster interfaces connected to the broadcast domain in all but one of the clusters.
MAC magic has two modes, manual and automatic. Automatic is the default and the recommended mode. Do not use manual mode unless Check Point Support tells you to use it.
Note - For more details, see sk25977.
To change the MAC magic value:
cpstat mg
command on Security Management Server or in the context of each Domain Management Server.cluster_magic
> click Find Next.cluster_magic
> select Edit.254 is the default value and should already be set. If duplicate Source MAC addresses of CCP packets appear on the network even though automatic mode is set, then enter unique values for each cluster (manual mode).
Enter a unique value for each cluster in the domain.
cphaprob mmagic
All Cluster Members of the same cluster should have the save MAC magic value.
Example:
[Expert@MemberB:0]# cphaprob mmagic
Configuration mode: Automatic Configuration phase: Stable
MAC magic: 100 MAC forward magic: 254
Used MAC magic values: None. |
To change the MAC magic ID during a Connectivity Upgrade (R80.10 and higher):
Before the upgrade, find out the current configuration mode.
cphaprob mmagic
The Configuration Mode field will show manual
or automatic
.
If the configuration field is automatic
, upgrade the cluster. The upgraded Cluster Member will learn the MAC magic value from a member that has not yet been upgraded (if a value exists). Select a value if no previous value exists.
Note - If the configuration field shows manual
, and you want to continue to use manual configuration, the same MAC magic value must be reused.
cphaprob mmagic
cphaconf cluster_id get
fw ctl get int fwha_mac_magic
cluster_magic
> click Find Next.cluster_magic
> select Edit.Note - When working in manual mode, the MAC magic value must be configured using GuiDBedit Tool before the first policy installation.
cphaprob mmagic
All Cluster Members of the same cluster should have the save MAC magic value.