> Source: [sk158712](https://support.checkpoint.com/results/sk/sk158712)

# sk158712 - MAC address flapping /link down on a switch connected to a Check Point VSX cluster

| Property | Value |
|----------|-------|
| Solution ID | sk158712 |
| Date Created | 2019-07-18 |
| Last Modified | 2021-01-18 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * The switch logs shows that Check Point MAC Address 0000.0000.XXXX is flapping between ports on the same VLAN, when the switch is connected to a VSX cluster.

* The problematic MAC address contains "0f" or another unexpected value in the 6th byte. For example:


  `FWM-6-MAC_MOVE_NOTIFICATION: Host 0000.0000.fd0f in vlan 1234 is flapping between port G0/0/0 and port G0/0/1`


  To determine if the value is expected or not, refer to [sk25977](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk25977).

* Changing the MAC magic value per [sk95150](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95150) does not resolve the issue - flapping persists, but now the new MAC magic value is in the 5th byte of the MAC address. 6th byte remains the same. For example:


  `FWM-6-MAC_MOVE_NOTIFICATION: Host 0000.0000.120f in vlan 1234 is flapping between port G0/0/0 and port G0/0/1`

* Changing MAC magic value for VS per [sk106651](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106651) doesn\`t resolve the issue - flapping persists, now we see the VS ID in the 4th byte of the MAC address. 6th byte remains the same. For example:


  `FWM-6-MAC_MOVE_NOTIFICATION: Host 0000.000a.fd0f in vlan 1234 is flapping between port G0/0/0 and port G0/0/1 `  
  `
  FWM-6-MAC_MOVE_NOTIFICATION: Host 0000.0008.fd0f in vlan 1234 is flapping between port G0/0/0 and port G0/0/1 `  
  `
  FWM-6-MAC_MOVE_NOTIFICATION: Host 0000.0014.fd0f in vlan 1234 is flapping between port G0/0/0 and port G0/0/1`

* Traffic captures collected on the Sync interface of the VSX cluster member show regular CCP packets as well as packets with the unexpected MAC (first packet in the provided example):


  `10:40:06.425983 00:00:00:00:fd:0f > Broadcast, ethertype IPv4 (0x0800), length 86: 0.0.0.0.cp-cluster > 10.20.30.40.cp-cluster: UDP, length 44`  
  `
  10:40:06.427984 00:00:00:00:10:01 > Broadcast, ethertype IPv4 (0x0800), length 94: 0.0.0.0.cp-cluster > 10.20.30.40.cp-cluster: UDP, length 52`  
  `
  10:40:06.433928 00:00:00:00:10:00 > Broadcast, ethertype IPv4 (0x0800), length 94: 0.0.0.0.cp-cluster > 10.20.30.40.cp-cluster: UDP, length 52`

## Cause

Switches learn the MAC mapping based on the source MAC of the packets over the incoming port. In the detailed scenario below, both VSX cluster members send the same CCP packets in the source MAC header, and as a result, the MAC flapping on the switch starts/ link down.

The VSX cluster has one or more virtual systems meeting the following criteria:   

* Initial Policy is installed.

<br />

* HA module is not started.

<br />

* In Cpinfo file the blades enabled on the VS are represented as "VS 3: Not supported for this VS". Compared to a working VS: "VS 5: fw".

When opening the traffic capture in Wireshark with CCP dissector enabled, the problematic packets are seen as CCP type 6 "Interface configuration reply", and are sent from a non-existing cluster member ID.  

* For example, a capture from a cluster with malformed CCP packets:  

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk158712/21907180058.png)  

  Note: In the above capture there are only two members in the cluster, - "Member 15" does not exist.

<br />

* Example of a capture from a correctly working VSX cluster:  

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk158712/11907180057.png)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content