> Source: [sk107496](https://support.checkpoint.com/results/sk/sk107496)

# sk107496 - ClusterXL in High Availability mode starts passing traffic only if TCPdump is started

| Property | Value |
|----------|-------|
| Solution ID | sk107496 |
| Date Created | 2015-08-27 |
| Last Modified | 2017-02-08 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Traffic does not pass through ClusterXL in High Availability mode in the following example topology:  

  Client --- (int.) \[ClusterXL\] (ext.) --- \[Router\] --- Server

* Traffic capture (tcpdump) on the inbound interface (int.) of cluster members (pointing to the Client) showed that the traffic enters the cluster.

* Connections between the Client and the Server were established as soon as TCPdump was started on the outbound interface (ext.) of cluster members (pointing to the Server).  

  The moment the TCPdump on the outbound interface was stopped, the connections were broken.

* Traffic capture (tcpdump) on the outbound interface (ext.) of cluster members (pointing to the Server) with addition of "-e" flag (to see the MAC addresses) showed that the next hop Router replied to the physical MAC address of Standby cluster member instead of MAC address associated with ClusterXL Virtual IP address:  

  `[Expert@HostName]# tcpdump -nei <Interface_Name> <IP_Address_of_Server>`

## Cause

The next hop Router has the wrong route and/or ARP entry defined.

Note: Running tcpdump on an interface puts the interface in *[promiscuous mode](https://en.wikipedia.org/wiki/Promiscuous_mode)* - the interface will accept all traffic it receives on the network.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content