> Source: [sk95150](https://support.checkpoint.com/results/sk/sk95150)

# sk95150 - When the Synchronization interfaces of three and more ClusterXL members are connected to the same switch, port flapping occurs on the switch

| Property | Value |
|----------|-------|
| Solution ID | sk95150 |
| Date Created | 2013-09-24 |
| Last Modified | 2019-07-16 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * When the Synchronization interfaces of three and more ClusterXL members are connected to the same switch, port flapping occurs on the switch.

* Issue occurs for ClusterXL in High Availability mode or in Load Sharing Multicast with Sticky Decision Function.

## Cause

When ClusterXL member in High Availability mode / in Load Sharing Multicast with Sticky Decision Function forwards a packet for processing to a peer member, the packet is forwarded over Synchronization Network.  
The Source MAC Address of a forwarded packet is set to 00-00-00-00-XX-ZZ, where:

* XX - value of kernel parameter '`fwha_mac_forward_magic`'
* ZZ - ID of destination cluster member, to which packet is being forwarded

If several ClusterXL members (e.g., Member_B and Member_C) forward their packets to the same peer member (e.g., Member_A), then the Source MAC Address of each forwarded packet would be identical.

This causes the switch, to which the Synchronization interfaces are connected, to "think" that the same Host is connect to different ports.  
*Example*:

1. Forwarded packet from *Member_B* enters via *Port_1* (and is forwarded to a Port, to which the *Member_A* is connected)
2. Switch updates its CAM table to indicate that the Host with MAC Address 00-00-00-00-XX-ZZ is connected to *Port_1*
3. Forwarded packet from *Member_C* enters via *Port_2* (and is forwarded to a Port, to which the *Member_A* is connected)
4. Switch updates its CAM table to indicate that the Host with MAC Address 00-00-00-00-XX-ZZ is connected to *Port_2*

Since there are multiple CCP packets, CAM table is frequently updated for the same MAC addresses. As a result, switch declares port flapping.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content