Cisco PIX 515E firewall produces incorrect ARP responses

Posted on 2007-08-01
Last Modified: 2010-04-09
We have a CISCO PIX 515E firewall (software version 6.2(2)). Unfortunately, there appears to be an issue with the ARP table. Whenever a server on our network sends a broadcast ARP request to determine the MAC address of another server, the firewall always responds with the MAC address of the firewall, causing the requesting server to receive 2 MAC addresses for the IP address in question. As a result, the requesting server occasionally assigns the incorrect MAC addresss for that IP address preventing IP packets from travelling between the two servers.

Do you know if there is likely to be a bug in the firmware for the firewall? And/or is there a way to configure this firewall to ignore any ARP requests? To get around this, we have created static entries in the ARP tables on all the servers.
Question by:jpguillebaud
    LVL 79

    Accepted Solution

    add this command to the PIX
      sysopt noproxyarp inside


    Author Comment

    Thank you Genius (you certainly are a genius!) I entered this command into the configuration of the firewall and now whenever I do an ARP request, I only receive the one required MAC address! Am I right in assuming that the firewall can be configured to work as a proxy server and hence it responds to all ARP requests by default?
    LVL 79

    Expert Comment

    Not as a proxy server per-say, but it has a tendency to answer up arp for anything within its assigned subnet.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
    Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now