> Source: [sk180441](https://support.checkpoint.com/results/sk/sk180441) # sk180441 - Traffic from a Host behind a Virtual System in a VSX Cluster / Scalable Platform Security Group in the VSX mode does not reach the destination | Property | Value | |----------|-------| | Solution ID | sk180441 | | Date Created | 2023-02-26 | | Last Modified | 2024-11-12 | | Technical Level | General | | Products | Security Gateway | | Versions | R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Symptoms - * Traffic from a Host behind a Virtual System in a VSX Cluster / Scalable Platform Security Group in the VSX mode does not reach the destination (through this Virtual System). * Traffic captures along the path from the source Host to the destination show that the Virtual System sends an ARP Request for the destination IP address, but there is no ARP Reply. * Adding a static ARP entry manually on the Virtual System resolves the issue. * In a VSLS configuration, moving all Active Virtual Systems to the same VSX Cluster Member resolves the issue. * Disabling the VMAC mode in the VSX Cluster resolves the issue. ## Cause The NIC driver on a VSX Cluster Member drops the ARP Reply packet because the Source MAC address of the ARP Request packet is identical to the MAC address of the Backplane interface that receives it. Because ARP fails, the original Virtual System cannot forward the traffic to the next hop. **Example Topology - short diagram:** \[Source Host\] == \[VS2\] == \[VS3\] == \[Destination Host\] **Issue:** Traffic (ping, ssh, etc) from the Source Host does not reach the Destination Host (the Management interface Magg0). **Example Topology - detailed diagram:** ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk180441/2024-04-11 00_36_57-Lab_Topology_HE-Mgmt_Team202404110038462.pptx - PowerPoint.png) **Root Cause:** 1. VS33 sends an ARP Request from the interface bondX.400 for the IP address of VS0 management interface (magg0). 2. In Scalable Platforms, the MAC Address of a management interface is derived from the physical Backplane (BP) interface (and not generated according to the Scalable Platform pattern, i.e. VMAC). Therefore, when the management interface (pseudo interface) sends a packet to another interface (pseudo interface) of the same physical Security Gateway / Security Group, the packet will be dropped. 3. The packet is dropped because the source MAC address (MAC of magg0 interface) is equal to the MAC address or the receiving interface (MAC of Security Group BP interface). In our example, the interface magg0 sends a packet to the interface bondX.400 (to get into the bondX.400's pseudo interface, first we have to go through the Backplane (BP) interface of the Security Gateway / Security Group, and at that point, the source MAC address of packet is identical to the MAC address of the receiving interface. ## Solution This problem was fixed. The fix is included in: * [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 90 If you choose not to upgrade and **VMAC is configured** , [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Management Server and Cluster Members involved in the case. **Hotfix installation instructions:** Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597). **If VMAC is not configured, OR if a workaround is required (applies only to NIC drivers that support the "disable-source-pruning" flag):** 1. Connect to the command line on **each** VSX Cluster Member / each Security Group Member on a Scalable Platform. 2. Log in to the Expert mode. 3. Check if the NIC driver of the applicable interfaces support the "source-pruning" flag: * On a Scalable Platform Security Group: 1. `ethtool --show-priv-flags ethsBP1-01` 2. `ethtool --show-priv-flags ethsBP1-02` * On a VSX Cluster (**not** a Scalable Platform Security Group): 1. `ethtool --show-priv-flags ` 2. `ethtool --show-priv-flags ` 3. `ethtool --show-priv-flags ` 4. `ethtool --show-priv-flags ` See 4. Temporarily disable the "source-pruning" flag in the NIC driver of the applicable interfaces: * On a Scalable Platform Security Group: 1. `ethtool --set-priv-flags ethsBP1-01 disable-source-pruning on` 2. `ethtool --set-priv-flags ethsBP1-02 disable-source-pruning on` * On a VSX Cluster (**not** a Scalable Platform Security Group): 1. `ethtool --set-priv-flags disable-source-pruning on` 2. `ethtool --set-priv-flags disable-source-pruning on` 3. `ethtool --set-priv-flags disable-source-pruning on` 4. `ethtool --set-priv-flags disable-source-pruning on` See 5. If this resolves the issue, then add these commands to the */etc/rc.d/rc.local* script to disable the "source-pruning" flag during each boot: 1. On a Scalable Platform, connect to the command line on the Security Group (not a specific Security Group Member). 2. Back up the current script: `cp -v /etc/rc.d/rc.local{,BKP}` 3. Edit the current script: `vi /etc/rc.d/rc.local` 4. At the bottom of the script add the applicable lines for the interfaces: |---------------------------------------------------------------------------------------------------------------------| | `#sk180441 - disabling 'source-pruning'` `ethtool --set-priv-flags disable-source-pruning on` | 5. Save the changes in the file and exit the editor. 6. On a Scalable Platform, copy the updated file to all Security Group Members: `asg_cp2blades /etc/rc.d/rc.local` --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content