On Fri, 2005-01-21 at 12:48 -0800, Dylan Martin wrote: > My redundant bridging firewall don't work no more with 3.6! >
> As background, the bridge interfaces have 'learn' disabled. That means, > they never cache information about which interface a packet came from. > (The inactive bridge would think all external hosts were attached to > the internal interface.) > > Internal Host A sends a packet for Internal Host B > Switch receives packet and records which port Host A is connected to. > Switch's mac address list doesn't contain Host B's Mac address Switch > floods the packet out all it's interfaces > Packet arrives at Bridge > Bridge doesn't know where Host B is, and because 'learn' is disabled, it > also doesn't know where Host A is. It floods the same packet out > all interfaces, including the one the packet came in on. > Packet arrives at Switch > Switch thinks Host A has moved to the port the Bridge is attached to > and starts sending all packets intended for Host A to the Bridge > instead. This continues until Host A sends out a packet that > corrects the Switch's idea of where Host A is. > Ahh!! so that's what is going on! We just moved our (very similar set up) to 3.6 and had similar problems. The the chief network guru went on holiday so we simply disabled one of the firewalls and waited until he gets back. We had not got to the stage of tracing individual packets through the network to figure out what was happening. > > If anyone has any ideas, please let me know. Me too :) Russell.
