During cutover of services for MA5200F at a site, the services are cut over to MA5200F from a router. Once upon completion of cutover to MA5200F, the users are L2 users under MA5200F, and the customer reports that a firewall fails.
Moreover, the upstream interface of firewall is configured with one IP address and multiple IPs.
Both MA5200F and the firewall run well, and there is no alarm information.
1. Check the configurations of MA5200F, and no problem is found.
2. Check the MAC entry of MA5200F, and the MAC of firewall is conflicted with that at MA5200F.
3. The upstream interface of the firewall is configured with multiple IP addresses, and they share the same MAC. In other words, one MAC corresponds to multiple IPs, and the firewall is one L2 user under MA5200F, but the L2 users of MA5200F do not support the application.
4. Change the firewall to be L3 user of MA5200F, and the problem is solved.
1. MA5200F is configured falsely.
2. The MAC of firewall conflicts with that of MA5200F.
3. The network planning is problematic.
MA5200F at each version does not support one MAC address of one L2 user corresponds to multiple IPs, and the later versions cannot solve the problem.
Therefore, when it is necessary for one MAC to correspond to multiple IPs, it needs to change the user at MA5200F to be L3 user.