-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Ignoring ARP responses that return multicast (or broadcast) MAC
addresses is required by the RFC1812 Section 3.3.2. Static ARP's are
the only options (or working on getting the RFC changed).
David
On Oct 17, 2008, at 3:00 PM, Crist Clark wrote:
I'm having a problem with a Check Point firewall cluster and
a Cisco router. The cluster is operating in "multicast load
sharing mode." In this mode, the unicast IP address of the
cluster is associated with all cluster machines by handing
out a multicast Ethernet address when the cluster gets an
ARP request for the address.
In a lab setup, I have a Cisco 851 connected to my two firewall
machines in the cluster. However, the Cisco router seems to
ignore the ARP responses containing the multicast Ethernet
address. If I sniff the connection between the two,
13:33:41.633395 arp who-has 192.168.111.42 tell 192.168.111.41
13:33:41.633403 arp reply 192.168.111.42 is-at 1:0:5e:28:6f:2a
13:33:44.462616 arp who-has 192.168.111.42 tell 192.168.111.41
13:33:44.462622 arp reply 192.168.111.42 is-at 1:0:5e:28:6f:2a
192.168.111.41 is the router. 192.168.111.42 is the firewall.
I've run,
#debug arp
On the router, and nothing interesting. I see it sending the ARP
requests, but it never mentions anything about seeing the responses.
If I add a static ARP entry,
#arp 192.168.111.42 0100.5e28.6f2a ARPA
Everything works fine.
Is there a way to tell the router to accept the ARP responses or
is the static entry the best option?
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)
iEYEARECAAYFAkj5FmEACgkQLa9jIE3ZamPUOQCgjdZVW50mMcp7hDOIaXjNXU+Q
MVwAnj4Dp3de2lDUrNdUtGFDETHDiJwg
=vb8u
-----END PGP SIGNATURE-----
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
