[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 557
  • Last Modified:

Cisco PIX 515E firewall produces incorrect ARP responses

We have a CISCO PIX 515E firewall (software version 6.2(2)). Unfortunately, there appears to be an issue with the ARP table. Whenever a server on our network sends a broadcast ARP request to determine the MAC address of another server, the firewall always responds with the MAC address of the firewall, causing the requesting server to receive 2 MAC addresses for the IP address in question. As a result, the requesting server occasionally assigns the incorrect MAC addresss for that IP address preventing IP packets from travelling between the two servers.

Do you know if there is likely to be a bug in the firmware for the firewall? And/or is there a way to configure this firewall to ignore any ARP requests? To get around this, we have created static entries in the ARP tables on all the servers.
0
jpguillebaud
Asked:
jpguillebaud
  • 2
1 Solution
 
lrmooreCommented:
add this command to the PIX
  sysopt noproxyarp inside

0
 
jpguillebaudAuthor Commented:
Thank you Genius (you certainly are a genius!) I entered this command into the configuration of the firewall and now whenever I do an ARP request, I only receive the one required MAC address! Am I right in assuming that the firewall can be configured to work as a proxy server and hence it responds to all ARP requests by default?
0
 
lrmooreCommented:
Not as a proxy server per-say, but it has a tendency to answer up arp for anything within its assigned subnet.
0

Featured Post

Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now