ebtables MAC snat -- does the original MAC still work as well?

G'day.  For a variety of complicated, and political, reasons, one of my
clients is looking at deploying a pair of Linux based firewalls in an
active/passive cluster -- and needs them to have a single, fixed MAC
address on the WAN side when they communicate with our upstream
provider.


While I would love to solve this in a better way, one of the options I
am investigating is using a simulated MAC address on the active machine,
to communicate with our upstream router.

It looks like ebtables, through the SNAT target, can implement what we
need: change the real MAC of our machines into a virtual MAC when we
talk to the upstream router.


There are three questions I have about this, though, that I couldn't
find answered in the documentation:

 - does the machine still respond on the original MAC as well as the
   SNAT MAC?
 
 - does the SNAT target take care of ARP traffic, or do I need to do
   that myself?

 - does this require running the interface in promiscuous mode, or have
   other performance implications beyond a little extra processing on
   each Ethernet frame?


Finally, is there something I have missed in my considerations here that
might make ebtables inappropriate, or that I might want to consider?

Also, has anyone else used this tool to successfully implement a
solution like this?

Regards,
        Daniel
-- 
Digital Infrastructure Solutions -- making IT simple, stable and secure
Phone: 0401 155 707        email: contact-gyMb1R/nBgM33TBCqt261WVqPpYm49HuKQEueVp/[email protected]
                 http://digital-infrastructure.com.au/


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642