Services fail after Virtual System failover in Maestro dual-site environment using the Same Virtual MAC feature

Product: Maestro HyperScale Firewall
Version: R81.10 (EOS), R81.20, R82
OS: Gaia
Platform: 16000
Last Modified: 2026-02-18

Symptoms

• After moving Virtual System (VS) from Chassis1 to Chassis2, all services behind the VS fail. This issue occurs consistently during multiple failover attempts.
• No return traffic is observed from the destination when the VS is active on Chassis2, although traffic reaches the VS interface. Returning the VS to Chassis1 restores normal service.
• Cluster status, policy, and logs appear normal; no drops are found.
• When the VS is active on Chassis2 or distributed across both sites, traffic slowness, VPN session drops, and inconsistent traffic flow are observed.
• Debug logs show repeated errors:

  fw_inspect_ghtab_bl_ld_sync: invalid FW_INSPECT_GHTAB_BL_LD_SYNC_TABLE_ID

• The environment uses the Same Virtual MAC (VMAC) address on both sites.

Cause

A Check Point code change caused Forwarding Database (FDB) entries in the Virtual Switch (VSW) to be set as static instead of dynamic when using the Same Virtual MAC (VMAC) address in a Virtual System Load Sharing (VSLS) Maestro dual-site environment.

When a Virtual System fails over to another site, the Virtual Switch ignores Gratuitous Address Resolution Protocol (GARP) updates. The FDB table retains the old MAC-to-port mapping, preventing correct traffic forwarding between sites.

Both sites use the same MAC address on data ports, but static FDB entries do not update during failover as expected.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R82 starting from Take 73
• Jumbo Hotfix Accumulator for R81.20 starting from Take 122
• Jumbo Hotfix Accumulator for R81.10 starting from Take 183

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2025-09-15
Last Modified: 2026-02-18