We recently switch to a new ISP, everything was working until we switched firewalls at this point only the primary IP of the new firewall would work. This was being caused by the ISP's ARP cache not updating things until the cache timed out. After doing some packet sniffing we realized that only the primary IP on the firewall is sending out an ARP request to update the ISP cache but the secondary IP's are not. I would think if something is sent to and IP and the ISP routers cache has old info that it would try and update if it is not working.
The ISP is telling use that its the firewalls problem because its not sending out an ARP saying here I am. I have tried at least 3 different firewalls with the same result.
So if we have our ISP clear there ARP cache or we wait for the cache to time out then everything works like it should.
Is this normal? I work for a small IT Services company and we have never had a problem like this before with any of the other ISPs we have ever dealt with.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Like I said if they clear it or we wait (up to 4 hours) things start to work again.
I would think that their router would be smart enough to send out an ARP to find out what MAC address the IP is assigned to if it wasn't valid any longer.
We have used a Cisco PIX, eSoft InstaGate and a PFSense firewall, all with the same result.
I had this problem with a cisco router. The only way I could get the router to generate a gratuitous arp for it's primary and secondary IP address was to temporarily change it's mac address and then change it back. I wonder if you can do this on your Cisco Pix.
Under the outside interface, see if you can do mac-address xxxx.xxxx.xxxx or mac address xxxx.xxxx.xxxx
where xxxx.xxxx.xxxx is an arbitrary mac-address then remove the config, with no mac-address xxxx.xxxx.xxxx
There are two mechanisms.
Gratuitous arp which the owner of the mac-address/ip pair performs. This informs everyone that it's using this ip address and makes sure no-one else is and prevents ip conflicts. Other devices can also update their arp caches when they here this.
The other mechanism is just ordinary arp, where the device that wants to communicate with you asks for your mac-address. If the source device already has your mac-address in it's cache then it won't ask until it's arp cache entry ages out.
Business Accounts
Answer for Membership
by: rochey2009Posted on 2009-11-04 at 12:39:12ID: 25743647
Hi,
Depending on the arp cache timer, it could take a while. Your ISP should be able to clear the arp cache manually.
Which firewall do you use?