<div>
Two questions:<br />
1. Are you implementing redundancy or high-availability.<br />
2. Does both the firewalls have same internal IP address, causing an IP conflict and hence the issue.<br />
<br />
Please advice.<br />
<br />
Thank you.
</div>


<div>
Thank You ,<br />
&quot;Are you implementing redundancy or high-availability&quot; - No <br />
&quot;Does both the firewalls have same internal IP address, causing an IP conflict and hence the issue&quot; No.<br />
<br />
The firewalls are being used as 2 different gateways. They seem to work fine together for a while and then they fail. Can be 1 minute or could take a hour or two. Around a certain time each day it will happen as soon as I plug them both in,
</div>


<div>
I just did a packet sniffer and found a lot of ARP requests. What is a ARP request and how dose the firewall use this information. If there are more then 1 firewall will this cause a problem The network has 3 Cisco Pix that are being used as gateways. These are the ones we will replace once things are stable.
</div>


<div>
ARP - Address Resolution Protocol is used for MAC address-IP address mapping; this information is used by any networking device to send frames to the correct device.<br />
<br />
Just to make sure you only have one default gateway on the machines.<br />
<br />
Can you also provide some more information about the IP subnet and other sanitized details from packet capture which you can share.<br />
<br />
Thank you.
</div>


<div>
have you tried reseting the sonicwalls to default installing new firmware and starting the setup wizard from scratch?
</div>


<div>
ccpjc,<br />
No I have not. Do you think I should? &nbsp;They were both in default when I got them and I just added the IP Info on the Networks.
</div>


<div>
The reason I requested subnet details was to understand how are the things connected.<br />
<br />
Frankly looking at packet capture does not help as there are no details as to why the packets were dropped or if there was a MAC/IP address duplication.<br />
<br />
Can you elaborate bit on the physical setup of the devices, and if possible with subnet; you might use junk subnets for posting and correlate with your actual subnets later.<br />
<br />
Thank you.
</div>


<div>
Well I will do the best I can. They have there one IT guy who setup the network and he is not the most organized person. From what I can tell, there are four routers/gateways all with the subnet 10.010.10.xxx. There are 4 48 port &nbsp;Cisco Catalyst 2960 switches that every thing is connected to. I did go into the switches and all the ports are setup as no type. He has half of the workstation's default gateways as 1 of the routers lets say 10.10.10.1 and the others 10.10.10.2 . This was his way of load balancing. There is one computer that has there own gate way of 10.10.10.3. She has a application that takes a lot of band with and needs her own t-1. Some of the workstations have a application that has there own router. From within the application you set the gateway the application uses. I know this is not the most detail description but it is what I know so far. Can you give me a direction to look . <br />
Thank You<br />
John
</div>


<div>
In this case I do not see any reason why the 2400s would have a problem.<br />
<br />
Each 2400 would be configured with its own ISP information, and only a specific set of hosts having a specific 2400 as default gateway would connect. They both would be in the same subnet.<br />
Only reason where we would have a conflict, which should not be the case, is if both the 2400 do proxy ARP for the internal subnet.<br />
<br />
In the packet capture, put a filter on source IP [with each 2400 specified], please check if you see ARP request going out for almost all the machines on the internal network.<br />
<br />
Please update.<br />
<br />
Thank you.
</div>


<div>
personally since you didn't setup the network and the other guy was messy as can be, I would reset the routers, make sure you take note of any special Access Rules or anything not standard so you can reprogram it in afterwards
</div>


<div>
Yes I do see ARP request going out for almost all the machines on the internal network
</div>


<div>
Is your Sonicwal configured in L2 bridge mode or transparent mode.
</div>


<div>
No it is not set for L2 bridge mode or transparent mode. It is set for static.
</div>


<div>
It should work then; can you reset the boxes as suggested by other experts and then configure again and check if the problem re-surfaces.<br />
<br />
Thank you.
</div>


<div>
Well we spent all day yesterday troubleshooting this. We brought in a Cisco expert to take a look at the switches. We found the switches that are connected to the Sonicwalls were maxing out the bandwidth. We setup one of the ports on the switch so we could use a sniffer. We set up Wireshark and found that when the problem accrued there was a massive amount of SNMP traffic coming from one server that is being used as a terminal server &nbsp;and then the Sonicwalls were sending them back out to there destination IP address. I spoke to Sonicwall support and they did verify that this was happening but could not tell me why it would happen. There only suggestion was to create a rule that would block the traffic. As this might solve the problem ,can anyone give me an idea as why this might happen? Creating a rule to block it sounds like a Band-Aid solution. I am not familiar with SNMP.<br />
<br />
Thank You<br />
John<br />

</div>


<div>
We found what was sending the traffic. It was a printer.<br />
Thank you for all your help.<br />
John
</div>


<div>
<div class="content wysiwyg-content">
Hi Experts,<br />
I have a customer that I am replacing there existing firewalls with 2 NSA 2400s. I set one up with no problem ,it is connected to a new T1 &nbsp;threw X1 port and to the internal network threw X0 port and then into one on the network switches. There are 4 Cisco network switches that are linked together. When I setup the other NSA 2400 and connect it to the network we start to have problems with the network. What happens is every so often you will see the activity light on both firewalls X0 port blink very fast and if you try to ping another IP on the network it times out. Also all the workstations on the network lock up there web activity. If I disconnect any one of the X0 ports it clears up. <br />
Thank You,<br />
John
</div>
</div>


Hi Experts,
I have a customer that I am replacing there existing firewalls with 2 NSA 2400s. I set one up with no problem ,it is connected to a new T1  threw X1 port and to the internal network threw X0 port and then into one on the network switches. There are 4 Cisco network switches that are linked together. When I setup the other NSA 2400 and connect it to the network we start to have problems with the network. What happens is every so often you will see the activity light on both firewalls X0 port blink very fast and if you try to ping another IP on the network it times out. Also all the workstations on the network lock up there web activity. If I disconnect any one of the X0 ports it clears up. 
Thank You,
John

2 Sonicwall NSN 2400s Taking Down Network When Both Are Pluged In

Hardware-based firewalls provide more sophisticated protection for inbound and outbound traffic than the simple Windows software firewall or the basic NAT firewalls found in routers. These devices implement techniques such as stateful packet inspection, deep packet inspection, and content filtering; and may include built-in antivirus and anti-malware protection.