A customer reported intermittent traffic blackholing during graceful failover events of a WatchGuard HA/VRRP firewall cluster connected to a pair of QFX5100 leaf switches operating within an EVPN fabric. During the outage, the VRRP virtual MAC address was simultaneously learned on both firewall-facing access interfaces, resulting in MAC mobility events and loss of forwarding stability.

Investigation determined that the EVPN fabric was correctly reacting to MAC ownership changes advertised by the connected firewalls. Evidence showed the VRRP virtual MAC being sourced from both firewall connections during failover, causing continuous MAC movement between local interfaces and remote EVPN VTEPs.

• Traffic blackholing during graceful WatchGuard firewall failover events.
• Connectivity restored after bouncing the firewall-facing interfaces.
• Intermittent behavior; failovers did not always trigger the problem.
• Same VRRP virtual MAC address observed on both firewall-facing interfaces simultaneously.
• Repetitive MAC move events observed in EVPN.
• MAC ownership continuously oscillated between local access interfaces and remote EVPN VTEPs.
• Clearing MAC entries did not permanently resolve the issue because the MAC was immediately relearned through EVPN advertisements.
• No evidence of an EVPN control-plane malfunction or route programming failure was observed

Analysis showed that the EVPN fabric was functioning as designed.

The VRRP virtual MAC address was learned locally on both leaf switches at approximately the same time:

Switch01:

<VIP mac address> learned on xe-0/0/43.0

Switch2:

<VIP mac address> learned on xe-0/0/46.0

As a consequence, EVPN generated MAC mobility events while ownership alternated between the local firewall-facing interface and the remote VTEP.

These indicate that:

1. The switch learned the virtual MAC locally from the firewall.
2. The same MAC was simultaneously received through EVPN advertisements from another leaf.
3. EVPN updated forwarding information based on the most recent advertisement.
4. The MAC continuously moved between locations, producing instability in forwarding decisions

The WatchGuard HA/VRRP implementation occasionally advertised or sourced traffic using the same VRRP virtual MAC from both firewall nodes during a failover event.

This caused:

• Simultaneous learning of the virtual MAC on multiple leaf switches.
• Continuous EVPN MAC mobility updates.
• Temporary forwarding instability.
• Traffic blackholing until MAC ownership converged

The issue was ultimately determined to be related to the behavior of the WatchGuard HA implementation rather than a switching, EVPN, or forwarding defect on the QFX platform. The customer later confirmed that introducing a Layer 2 device between the leaf switches and the firewall cluster resolved the issue and aligned with guidance received from the firewall vendor.