>> > RFC 1812 section 3.3.2 says it shouldn't work: >> > A router MUST not believe any ARP reply that claims that the Link >> > Layer address of another host or router is a broadcast or multicast >> > address. > >> Yep, this is a Checkpoint cluster connected to Cisco switches. Once I >> discovered the right search terms, I found the configuration guide on CCO. I >> had never heard of this before. I think we've decided against it since it >> would >> require static entries on 20 switches and 10 routers. I think they decided to >> launch this in unicast mode for now and we might revisit multicast mode >> some other time. > > My interpretation of the original post was that the multicast address was in > the Ethernet header (7th byte of the frame is an odd number). > > But it sounds like the multicast address is appearing in the Sender MAC field > of the ARP reply. > > Which behavior is it, exactly? >
That's a good question, and I don't have an answer. I'm not sure about the specific behavior of these firewalls. Our security guys just now decided to deploy these in unicast mode, so I guess it's a moot point now. :) Thanks for your help, John _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
