From the following output of cphaprob state, which ClusterXL mode is this?

Dejan C.Nov 3, 2025

The correct answer is D, Unicast mode. In ClusterXL, cphaprob state will show you the cluster topology and the mode it is operating in, and Unicast mode is identifiable because all cluster members share the same virtual MAC address while the Security Management Server communicates with the cluster through a single IP, with one member acting as the pivot that forwards traffic to other members. Multicast mode, by contrast, uses a multicast MAC so switches receive frames on all ports simultaneously, no forwarding between members needed. Legacy mode is the old High Availability active/standby behavior, not the load-sharing topology that Unicast implies, and "New mode" is not a real ClusterXL designation at all. When you see in cphaprob state that the cluster is using a shared virtual MAC with one member handling the forwarding role, that is your confirmation you are looking at Unicast mode.

Fatima Z.Oct 15, 2025

Picked B first, but one shared IP hollered UNICAST, so D.

Anjali D.Nov 1, 2025

Alright so our group has been going back and forth on this one and I want to share where we landed. The key giveaway in cphaprob state output for Unicast mode is that you will see a single virtual MAC address shared across the cluster members, with one gateway acting as the pivot that forwards traffic, and the interface line will show that same MAC on all sync interfaces. Multicast mode uses a multicast MAC and you would see that reflected differently in the state table, and Legacy versus New mode is about how the cluster was configured in older versus newer SmartDashboard versions, not directly visible in cphaprob state output in the same way. When I sat the exam last spring I almost second-guessed myself toward Multicast because I remembered the MAC being shared, but then I recalled that in Multicast the MAC starts with 01:00:5e which flags it as a multicast address, and the output in the question did not show that prefix at all, so I went with D and it was correct. Can anyone else share what indicators you look for in the cphaprob state output to distinguish the two? Would love to hear if the group found a faster elimination method for this type of question.