We using a multicast MAC address, below is the relavent configs of the route modules and the switches.
On the switches we have placed a cam permanent statement to the trunk port connecting to the other switch and also to the port on which one of the firewalls are connected to.
LDC-PRIMARY-4006> (enable) sho cam permanent
* = Static Entry. + = Permanent Entry. # = System Entry. R = Router Entry.
X = Port Security Entry
VLAN Dest MAC/Route Des [CoS] Destination Ports or VCs / [Protocol Type]
---- ------------------ ----- -------------------------------------------
69 01-00-5e-7c-02-02 + 1/2,2/12
Total Matching CAM Entries Displayed = 1
LDC-SECONDARY-4006> (enable) sho cam perm
* = Static Entry. + = Permanent Entry. # = System Entry. R = Router Entry.
X = Port Security Entry
VLAN Dest MAC/Route Des [CoS] Destination Ports or VCs / [Protocol Type]
---- ------------------ ----- -------------------------------------------
69 01-00-5e-7c-02-02 + 1/2,2/12
Total Matching CAM Entries Displayed = 1
On the route modules we have them running hsrp. and we've added an arp entry for the multicast mac address of the firewalls. All routes point to the virtual address of the firewalls.
On the primary,
!
interface Port-channel1.69
description *** 'Internal' DMZ. LDC 69 VLAN ***
encapsulation dot1Q 69
ip address 203.14.69.2 255.255.255.224
ip access-group 110 in
no ip redirects
no ip directed-broadcast
ip accounting output-packets
standby 69 priority 140 preempt
standby 69 ip 203.14.69.1
!
arp 203.14.69.17 0100.5e7c.0202 ARPA
On the secondary
!
interface Port-channel1.69
description *** 'Internal' DMZ. LDC 69 VLAN ***
encapsulation dot1Q 69
ip address 203.14.69.3 255.255.255.224
no ip redirects
no ip directed-broadcast
ip accounting output-packets
standby 69 priority 130 preempt
standby 69 ip 203.14.69.1
!
arp 203.14.69.17 0100.5e7c.0202 ARPA
