Setup

ClusterXL active-active
L2 / Bridge


Issues
No issue on the traffic over the bridge, issue happen only when the traffic that comes in interface01 will need to return back to the same inteface (interface01). The traffic will be dropped by the firewall in kernal space.

Diagnostic
As the setup is on L2, the concept of bridging in place, for example. 



servers farm with multiple vlans --- int01/firewall/int02 --- external(gateway for all the server/vlan in the server farm)

Based on the flow above, when the traffic from server in the server farm (serverA in vlan10) need to talk to another server in the same server farm (serverB in vlan20). The traffic will go to the gateway (which at the "external") the traffic need to go through int01 on the firewall. As the traffic hit int01, the firewall will have conflicting decision on where to pass the traffic, as when its in the firewall, the firewall will see 2 path, which is back to the int01 as the ServerB vlan is visible in the firewall, or pass it through the bridge towards the gateway. In network matrix, lower layer will take precedence. This will make the firewall passing the traffic back to the int01. This will cause the firewall(kernel) drop the traffic as it sees the same traffic on int01 (this is basic explanation).


Solution

Checkpoint Documentation Suggest;

```
Routing and Bridge Interfaces
Security Gateways with a Bridge interface can support Layer 3 routing over non-bridged interfaces. If you configure a Bridge interface with an IP address on a Security Gateway (not on Cluster Members), the Bridge interface functions as a regular Layer 3 interface. It participates in IP routing decisions on the Security Gateway and supports Layer 3 routing.

- Cluster deployments do not support this configuration.
- You cannot configure the Bridge interface to be the nexthop gateway for a route.
- A Security Gateway can support multiple Bridge interfaces, but only one Bridge interface can have an IP address.
- A Security Gateway cannot filter or transmit packets that it inspected before on a Bridge interface (to avoid double-inspection).
```

To resolve the issue, we need to "force" the firewall not to drop the traffic by enabling the reroute and also disabling the anti-spoofing (the mechnism that drop the traffic).

edit the fwkern.conf file
$FWDIR/boot/modules/fwkern.conf

```
fw_antispoofing_enable=0
fwx_bridge_reroute_enable=1
```