> Source: [sk105577](https://support.checkpoint.com/results/sk/sk105577)

# sk105577 - Traffic does not pass through ClusterXL with enabled VMAC mode and SecureXL

| Property | Value |
|----------|-------|
| Solution ID | sk105577 |
| Date Created | 2015-04-07 |
| Last Modified | 2016-01-13 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Clients are not able to connect to Server through ClusterXL in the following scenario:

  * Virtual MAC (VMAC) mode is enabled on ClusterXL (per [sk50840](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk50840))
  * SecureXL is enabled on ClusterXL
* Traffic capture on ClusterXL shows:

  * Traffic from Client to Server passes through ClusterXL successfully.
  * The return traffic from Server to Client enters the ClusterXL, but is never forwarded to Client.
* Disabling only SecureXL on ClusterXL resolves the issue.

* Disabling only Virtual MAC (VMAC) mode on ClusterXL resolves the issue.

* ClusterXL debug ('`fw ctl debug -m cluster + drop`') shows that the involved traffic is dropped by the cluster code:  

  `fwha_select_ip_packet: dropping packet that arrived on ifn IF <Interface_Name> (<IfNumber> - vmac - <Virtual_MAC_Address>)`

## Cause

Cluster code drops packets that were forwarded by SecureXL on Medium path (PSL, QoS, VPN accelerated packets).

Flow of events:

1. First packet from Client to Server is always forwarded by SecureXL to FireWall.
2. Since Virtual MAC (VMAC) mode is enabled, packet's destination MAC address is changed.  
   SecureXL SIM debug ('`sim dbg -m drv + pkt routing`') would show:  
   `;[cpu_`*N* `];[SIM...]dst mac: 00:1c:7f:`***YY:YY:YY***` <--> src mac: XX:XX:XX:XX:XX:XX;`
3. Packet undergoes full inspection.
4. If connection is accepted, then FireWall offloads this connection (as accepted) to SecureXL.
5. The return traffic from Server to Client is processed by SecureXL.
6. If the involved packet must go through Medium path (PXL/QoS/VPN), then SecureXL must forward it to FireWall.
Since Virtual MAC (VMAC) mode is enabled, packet's source MAC address is changed.  
SecureXL SIM debug ('`sim dbg -m drv + pkt routing`') would show:  
`;[cpu_`*N* `];[SIM...]dst mac: XX:XX:XX:XX:XX:XX <--> src mac: 00:1c:7f:`***ZZ:ZZ:ZZ***`;`
7. Cluster code drops this packet because internal destination MAC Address does not match the VMAC address of incoming interface.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content