> Source: [sk120257](https://support.checkpoint.com/results/sk/sk120257)

# sk120257 - ClusterXL with PIM Sparse-Mode fails to forward Multicast traffic upon a failover

| Property | Value |
|----------|-------|
| Solution ID | sk120257 |
| Date Created | 2017-09-10 |
| Last Modified | 2017-09-11 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * ClusterXL configured with PIM Sparse mode, stops forwarding multicast traffic after a failover.
* "ip mroute" shows that the Oif list contains both the outgoing interfaces and "pimreg0":  
  (***Multicast source*** , ***Multicast group*** ) Iif: eth2 Oifs: **pimreg0** eth3
* The RP replies to a Register-null sent by the Active member twice:  
  First packet is sent toward the VIP address of the interface facing the Multicast source.  
  Second packet is sent toward the physical address of the Standby member, of the interface facing the RP.  

  **tcpdump** shows that the second Register-stop is being sent to the Standby from the Source of the RP, however the source MAC address is the MAC address of the **Active member** . For example:  

  11:16:57.139665 cc:cc:cc:cc:cc:cc \> **aa:aa:aa:aa:aa:aa** , ethertype IPv4 (0x0800), length 52: 1.1.1.100 \> 100.0.0.1: PIMv2, Register Stop, length: 18  
  11:16:57.140228 **aa:aa:aa:aa:aa:aa** \> bb:bb:bb:bb:bb:bb, ethertype IPv4 (0x0800), length 60: 1.1.1.100 \> 1.1.1.2: PIMv2, Register Stop, length: 18  

  **Explenation:**
  * **aa:aa:aa:aa:aa:aa** - MAC of the new Active member
  * **bb:bb:bb:bb:bb:bb** - MAC of the Standby member
  * **cc:cc:cc:cc:cc:cc** - MAC of the RP
  * **1.1.1.100** - IP of the RP
  * **100.0.0.1** - VIP of the interface facing the Multicast source
  * **1.1.1.2** - Physical IP of the interface facing the RP **of the standby member**
* VMAC is disabled on the ClusterXl. The Cluster is registering Multicast traffic toward the RP, and the Multicast source is in a local subnet of the Cluster.

## Cause

The Active member creates a connection for the PIM Register process, using the VIP as the Source.  
The Active member synchronize the connection to the Standby including NAT opaque during the failover.

As a result, the Active member translates the destination IP to the physical IP of the Standby member, and forward it the packet.  
This causes the Active member to continue registering the Multicast traffic, and not handle the Register-stop sent by the RP.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content