> Source: [sk178664](https://support.checkpoint.com/results/sk/sk178664)

# sk178664 - Returning traffic from the active to the standby uses the MAC address 00:01:00:00:fd:01 or 00:01:00:00:fd:00

| Property | Value |
|----------|-------|
| Solution ID | sk178664 |
| Date Created | 2022-04-17 |
| Last Modified | 2022-04-20 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * The active member uses either virtual MAC addresses 00:01:00:00:fd:01 or 00:01:00:00:fd:00 depending on the Member ID to forward the traffic back to the standby member
* When more than 1 cluster is configured on the same VLAN segment, the switch starts port flapping.

## Cause

The cluster uses the Forwarding layer to send the returning traffic back to the standby member, and the return traffic is sent with the source MAC address set upon by the Forwarding Magic MAC value, which is set to 253 by default for all deployed clusters.

## Solution

This problem was fixed. The fix is included starting from  

* **[Check Point R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114&partition=Basic&product=All)**
* [**Check Point R81.10**](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175186)

Check Point recommends to always upgrade to the most recent version ([Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435) / [VSX](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=359) / [Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166) / [SmartConsole](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=191)).  

<br />

To resolve the issue, a unique MAC forward magic value for each cluster can be chosen. This allows for the 5th section of the MAC address to be unique for each cluster.  

To check the Magic ID, run: `# fw ctl get int fwha_mac_forward_magic`  

To set the Magic ID, run: `# fw ctl set int fwha_mac_forward_magic`  

Example:  

|-------------------|-----------------------------|
| **MAC address**   | **MAC Forward Magic Value** |
| 00:01:00:00:fd:01 | 253                         |
| 00:01:00:00:5a:01 | 90                          |
| 00:01:00:00:46:01 | 70                          |

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content