> Source: [sk102270](https://support.checkpoint.com/results/sk/sk102270)

# sk102270 - Traffic sent by ClusterXL configured in VMAC mode does not reach its destination when it passes through Cisco ACE Load Balancer or Switch

| Property | Value |
|----------|-------|
| Solution ID | sk102270 |
| Date Created | 2014-09-02 |
| Last Modified | 2021-05-03 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Return traffic sent by ClusterXL configured in VMAC mode does not reach its destination when it passes through Cisco ACE Load Balancer.
* Return traffic sent by ClusterXL configured in VMAC mode does not reach its destination when it passes through Cisco Switch.

## Cause

Flow of events:

1. Cisco Device originally sends an ARP Request for the ClusterXL Virtual IP address.
2. ClusterXL replies with the VMAC address.
3. Cisco Device updates its ARP table with association of ClusterXL VIP address to ClusterXL VMAC.
4. By design, traffic that is originated from ClusterXL configured in VMAC mode is sent with the Source MAC address of cluster member's physical interface and with Source IP address of ClusterXL VIP.
5. Cisco Device uses the Source MAC address from the first packet of a new connection to determine the device that sent the return traffic and checks the Source MAC of the return packet against its ARP Table.
6. Since the ARP Table contains different MAC entries for ClusterXL VIP, Cisco Device drops the traffic on the receiving interface.

## Solution

**Two options are available:**

1. Do not use VMAC mode in ClusterXL environments, which are connected to Cisco ACE Load Balancers or Switches  

2. Disable the Mac-Sticky Feature on the Cisco ACE Load Balancers:

   **`host/Admin(config-if)# no mac-sticky enable`**
   For additional information, refer, for example, to the following [Cisco Article](http://www.cisco.com/c/en/us/td/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/routing_bridging/guide/rtbrgdgd/vlansif.html#wp1062440).
3. Disable the Mac-Sticky Feature on the Cisco Switch:  

   **`Router(config-if)# ip sticky-arp ignore`**   

   For additional information, refer, for example, to the following [Cisco Article](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_arp/configuration/xe-2/arp-xe-2-book/arp-config-arp.html).

A **workaround** would be to create the *first* NAT rule to *not* translate sessions with Source IP address of the cluster members.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content