I am moving public, routable IP addresses from Linux boxes to a Cisco ASA 5505 firewall as part of moving client web sites to new servers behind the firewall and on a local network with non-routable addresses (i.e. WAN-to-LAN NAT on the firewall). I'm sure that I'm running into a problem with our network switch on the public side, because when I drop the interface on the Linux box and add the address to the WAN side of the firewall, I get no response for up to hours at a time. It eventually clears up, but I have a whole Class C of addresses to change, and I need faster cut-over time. I know that if this were all on the same subnet as the new server, I could broadcast the ARP information using "arping" to get the switch to clear, but the problem is that the new server is behind the firewall on a local address.
What I need is for the firewall itself to broadcast the ARP information on the WAN side, and not just for its base IP address, but specifically for the WAN IP address I've just added to it. Is this possible? I can't find any documentation other than viewing and clearing or setting the timeout of the ARP cache on the firewall itself. If I can't get the firewall to broadcast newer MAC information to the switch, does anyone know of a creative alternative to get the switch to pick up the address faster? (Obviously, I don't have administrative control of the switch.)
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
It sounds like you are stuck because the ISP switch is not aging out their old entry fast enough. Can you get them to set the ARP age out time lower? Another thing would be to use a different address in the range they gave you for the public side of the firewall if there is a range so you don't have a conflict with the old address.
Thanks @lrmoore and @Rick_O_Shay for responding, but I haven't accepted as a solution these posts just yet because my original request was to know whether the Cisco firewall is capable of doing something equivalent to an "arping" or to know whether there is a competely different way to force a switch I do not management to pick up the new MAC/IP association. Could be that what all three of us know is simply the only solution; to wait for the ARP cache to timeout, or the other obvious answer, to ask the ISP to clear the cache manually. If there are no other posts within a day or two, I will accept.
Hi, Rick_O_Shay: There is a flag with "arping" that allows you to broadcast the message from the source IP you select to the entire collision domain, and since it's a broadcast and hits all ports of the switch, it usually "wakes up" the switch to the fact that the IP address it has cached with an association to a different MAC is stale and it will usually drop the data from its cache and pick up the new association. At least in theory; I guess it ultimately depends on the programming of the switch itself.
Business Accounts
Answer for Membership
by: lrmoorePosted on 2009-11-08 at 04:43:46ID: 25770300
This is proxyarp and is usually enabled by default on per-interface.
Look for a line in the config
sysopt noproxyarp outside
If it is there, then proxyarp is disabled and you will want to remove it.
If you had admin control of the switch you could just clear its arp cache which could still be a problem no matter what you do until that cache times out or is cleared manually.