> Source: [sk182039](https://support.checkpoint.com/results/sk/sk182039)

# sk182039 - All traffic from internal networks to the Internet is interrupted after a failover in ClusterXL in the High Availability mode

| Property | Value |
|----------|-------|
| Solution ID | sk182039 |
| Date Created | 2024-03-19 |
| Last Modified | 2025-01-16 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * All traffic from internal networks to the Internet is interrupted after a failover in ClusterXL in the High Availability mode.

* Traffic capture on the new Active cluster member (with tools like CPpcap ([sk141412](https://support.checkpoint.com/results/sk/sk141412)) or FW Monitor ([sk30583](https://support.checkpoint.com/results/sk/sk30583))) shows that it correctly forwards the traffic from internal networks to the Internet. However, there is no response.

* Traffic capture on the new Standby cluster member shows that the upstream (ISP) network device was still sends the response traffic from the Internet to the physical MAC address of the new Standby cluster member (former Active cluster member).

* Kernel debug on the new Active cluster member (`fw ctl zdebug + drop | grep <IP_ADDRESS>`) does not show any drops of the involved traffic.

* Kernel debug on the new Standby cluster member (`fw ctl zdebug + drop | grep <IP_ADDRESS>`) shows that it silently drops the involved traffic (as it is designed to do).

* Traffic capture of ARP traffic on both cluster members shows that the new Active member correctly sends the Gratuitous ARP (G-ARP) packets after the failover with the MAC address of the new Active member.

  `tcpdump -nnei <NAME_of_EXTERNAL_INTERFACE> arp`
* Enabling the Virtual MAC (VMAC, [sk50840](https://support.checkpoint.com/results/sk/sk50840)) mode does not resolve the issue.

## Cause

After a cluster failover, the upstream switch / router still sends the traffic from the Internet to the MAC Address of the former Active cluster member.

The upstream switch / router ignores the Gratuitous ARP (G-ARP) packets that the new Active cluster member sends to notify network devices that a new MAC Address is associated with the Cluster Virtual IP address.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content