> Source: [sk119052](https://support.checkpoint.com/results/sk/sk119052)

# sk119052 - Virtual Router on Standby VSX member answers GARP packets with its own MAC address

| Property | Value |
|----------|-------|
| Solution ID | sk119052 |
| Date Created | 2017-07-19 |
| Last Modified | 2018-08-24 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Virtual Router on Standby VSX cluster member answers GARP packets with its own MAC address in the following scenario:

  1. Proxy ARP (for Virtual System's IP address) is configured on the Virtual Router of VSX cluster:  
     --- \[Virtual System\]{wrp} --- {wrpj}\[Virtual Router\](VR performs Proxy ARP for VS's IP address) ---
  2. Active VSX cluster member sends the periodic Gratuitous ARP packets
  3. Virtual Router on Standby VSX cluster member sends ARP Reply with the MAC address of Standby Standby VSX cluster

  *Example*:

  ```
  
  [Expert@VSX-Standby:1]# tcpdump -nei any arp | grep 1.1.1.1
  
  22:03:42.598237 Out AA:AA:AA:AA:AA:AA ethertype ARP (0x0806), length 44: arp who-has 1.1.1.1 tell 1.1.1.1
  22:03:42.598564  In BB:BB:BB:BB:BB:BB ethertype ARP (0x0806), length 62: arp reply 1.1.1.1 is-at BB:BB:BB:BB:BB:BB
  22:03:42.598606 Out AA:AA:AA:AA:AA:AA ethertype ARP (0x0806), length 44: arp reply 1.1.1.1 is-at BB:BB:BB:BB:BB:BB
  ```

  Explanations
  * Active VSX cluster sends GARP packets to advertise the IP address ***1.1.1.1*** with Virtual Router's MAC address ***AA:AA:AA:AA:AA:AA***
  * As the IP address ***1.1.1.1*** in the GARP packets matches the Standby VSX cluster member's IP address as well,  
    VSX cluster member replies to the GARP with its own MAC address ***BB:BB:BB:BB:BB:BB***, although it is in the Standby state
* In addition, both VSX cluster members reply to ARP Requests for proxied Virtual System's IP address.

## Cause

The Virtual Router does not check the cluster state (Active or Standby) before processing these ARP packets.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content