> Source: [sk94564](https://support.checkpoint.com/results/sk/sk94564)

# sk94564 - ARP Requests sent from the Standby Virtual System cause switch to send traffic to the Standby Virtual System

| Property | Value |
|----------|-------|
| Solution ID | sk94564 |
| Date Created | 2013-08-24 |
| Last Modified | 2026-02-18 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * ARP Requests sent from the Standby Virtual System cause switch to send traffic to the Standby Virtual System.
* Issue was reported for a Layer 3 switch, which contains a table consisting of the packet source IP address, packet MAC address and switch port, on which the packet was received.

## Cause

Chain of events:

1. By default, each cluster member sends ARP Requests with Cluster Virtual IP address and the MAC address of the Active member in the source of the ARP payload.
2. When receiving an ARP Request from the Active Virtual System, the switch binds the MAC address and the VIP in the source ARP payload to the port that is connected to the Active member.
3. When receiving an ARP Request from the Standby Virtual System, the switch binds the MAC address and the VIP in the source ARP payload to the port that is connected to the Standby member.
4. As a result, the same cluster VIP and MAC is now bound to the port connected to the Standby member.
5. This causes the traffic to be returned to the Standby member instead of the Active member.

## Solution

### Fix description

To overcome the problem, the code was changed in the following way:

1. The ARP Request is sent from a warp interface from the Standby member to the network.
2. The Standby member intercepts the ARP Request and sends it directly to the Active member by modifying the destination MAC address in Ethernet header.
3. The Active member then sends the ARP Request to the network.
4. Upon receiving the ARP Reply, the Active member resends the ARP Reply to all the other members.

In order to control the new behavior, new global kernel parameter was added - **`fwha_arp_forward_standby`**.

In order to enable the new behavior set the value of this kernel parameter **`fwha_arp_forward_standby`** to **1** (one) **on all cluster members** .  
In addition, set the value of the existing parameter **`fwha_resend_arp_unicast`** to **1** (one) **on all cluster members** (this parameter changes the way ARP packets are resent to other cluster members from "broadcast" to "unicast").

### Procedure

**Note:** In cluster environment, this procedure must be performed on all members of the cluster.

* Show / Hide instructions for R77.10 and above  
  * To check the current value of a kernel parameter:

    **`[Expert@HostName]# fw ctl get int fwha_arp_forward_standby`**   
    **`[Expert@HostName]# fw ctl get int fwha_resend_arp_unicast`**
  * To enable the new behavior *on-the-fly* (does not survive reboot):

    **`[Expert@HostName]# fw ctl set int fwha_arp_forward_standby 1`**
  * To disable the new behavior *on-the-fly* (does not survive reboot):

    **`[Expert@HostName]# fw ctl set int fwha_arp_forward_standby 0`**   

  * fwha_resend_arp_unicast cannot be set on-the-fly with "fw ctl set int" command. Only permanently via $FWDIR/boot/modules/fwkern.conf file. Refer to sk107432.
  * To enable the new behavior *permanently*:

    Follow [sk26202 (Changing the kernel global parameters for Check Point Security Gateway)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk26202):
    1. Create the `$FWDIR/boot/modules/fwkern.conf` file (if it does not already exit):

       **`[Expert@HostName]# touch $FWDIR/boot/modules/fwkern.conf`**
    2. Edit the `$FWDIR/boot/modules/fwkern.conf` file in Vi editor:

       **`[Expert@HostName]# vi $FWDIR/boot/modules/fwkern.conf`**
    3. Add the following line (spaces are not allowed):

       **`fwha_arp_forward_standby=1`**   
       **`fwha_resend_arp_unicast=1`**   

    4. Save the changes and exit from Vi editor.
    5. Check the contents of the `$FWDIR/boot/modules/fwkern.conf` file:

       **`[Expert@HostName]# cat $FWDIR/boot/modules/fwkern.conf`**   

    6. Reboot the machine.
* Show / Hide instructions for R75.40VS, R76 and R77  
  **Hotfix installation instructions:**
  1. Hotfix has to be installed on **all cluster members**.

     [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.  
     A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
     For faster resolution and verification, please collect [CPinfo files](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Security Management Server and Security Gateways involved in the case.   

  2. Transfer the hotfix package to each cluster member (into some directory, e.g., `/some_path_to_fix/`).
  3. Unpack the hotfix package:

     **`[Expert@HostName]# cd /some_path_to_fix/`**   
     **`[Expert@HostName]# tar zxvf fw1_wrapper_`*HOTFIX_NAME*`.tgz`**
  4. Install the hotfix on each cluster member:

     **`[Expert@HostName]# ./fw1_wrapper_`*HOTFIX_NAME***   

  5. Do not reboot yet.
  6. Enable the new behavior *permanently*:

     Set the value of both kernel parameters - **`fwha_arp_forward_standby`** and **`fwha_resend_arp_unicast`** to **1** (one) per [sk26202 (Changing the kernel global parameters for Check Point Security Gateway)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk26202):
     1. Create the `$FWDIR/boot/modules/fwkern.conf` file (if it does not already exit):

        **`[Expert@HostName]# touch $FWDIR/boot/modules/fwkern.conf`**
     2. Edit the `$FWDIR/boot/modules/fwkern.conf` file in Vi editor:

        **`[Expert@HostName]# vi $FWDIR/boot/modules/fwkern.conf`**
     3. Add the following line (spaces are not allowed):

        **`fwha_arp_forward_standby=1`**   
        **`fwha_resend_arp_unicast=1`**   

     4. Save the changes and exit from Vi editor.
     5. Check the contents of the `$FWDIR/boot/modules/fwkern.conf` file:

        **`[Expert@HostName]# cat $FWDIR/boot/modules/fwkern.conf`**
  7. Reboot each cluster member.
  8. Check the current value of a kernel parameter:

     **`[Expert@HostName]# fw ctl get int fwha_arp_forward_standby`**   
     **`[Expert@HostName]# fw ctl get int fwha_resend_arp_unicast`**

  Notes:
  * To disable the new behavior *on-the-fly* (does not survive reboot):

    **`[Expert@HostName]# fw ctl set int fwha_arp_forward_standby 0`**   
    **`[Expert@HostName]# fw ctl set int fwha_resend_arp_unicast 0`**
  * To enable the new behavior *on-the-fly* (does not survive reboot):

    **`[Expert@HostName]# fw ctl set int fwha_arp_forward_standby 1`**   
    **`[Expert@HostName]# fw ctl set int fwha_resend_arp_unicast 1`**

**Related solutions:**

* [sk107432 - Traffic originated by the Standby cluster member does not work](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk107432)
* [sk120158 - "Source address of packet received from 0000.XXXX.XXXX on Name_of_Interface(Name_of_Port) is duplicate of local virtual ip, X.X.X.X" log on Cisco switch connected to Check Point cluster members](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk120158)
* [sk92931 - Gratuitous ARP sent by Check Point cluster in broadcast cause Cisco devices to notify about duplicate IP address and not to pass the traffic to this IP address](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92931)
* [sk168181 - Communication problems with ClusterXL clusters connected to Cisco ACI](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168181)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content