Data center system

A data center system comprising:

• at least two data center subsystems interconnected through a layer-2 network, each of the at least two data center subsystems comprising a plurality of hosts, one or more layer-2 switches connected with the plurality of hosts, a firewall system connected with the one or more layer-2 switches, and a layer-2 extension device connected with the one or more layer-2 switches, wherein the firewall system comprises one or more firewalls, and wherein the one or more layer-2 switches, the firewall system, and the plurality of hosts in one of the at least two data center subsystems are in a communication channel;
• wherein the firewall systems of the at least two data center subsystems are configured to transmit synchronization information to each other through a synchronization channel in a first virtual local area network, the synchronization channel being separate from the communication channel;
• wherein the layer-2 extension devices of the at least two data center subsystems are configured to transmit service information to each other through a service channel in a second virtual local area network, the service channel being separate from the communication channel;
• wherein the first virtual local area network and the second virtual local area network are implemented in the layer-2 network;
• wherein in at least one of the at least two data center subsystems, the firewall system comprises multiple firewalls;
• wherein the firewall system of the at least one of the at least two data center subsystems has a service interface configured with a first MAC address, a second MAC address and a third MAC address;
• wherein at least one of the firewalls in the firewall system of the at least one of the at least two data center subsystems is configured to use the first MAC address as a destination MAC address when receiving packets from outside the firewall system of the at least one of the at least two data center subsystems;
• wherein at least one of the firewalls in the firewall system of the at least one of the at least two data center subsystems is configured to use the second MAC address as a source MAC address when sending packets out of the firewall system of the at least one of the at least two data center subsystems;
• and
• wherein at least one of the firewalls in the firewall system of the at least one of the at least two data center subsystems is configured to use the third MAC address to communicate with another one of the firewalls in the firewall system of the at least one of the at least two data center subsystems.