topic Re: Cisco ASA allowed Arp alias , can Paloalto do arp alias? in Next-Generation Firewall Discussions

Cisco ASA allowed Arp alias , can Paloalto do arp alias?

marianneogorman — Fri, 22 Sep 2023 18:49:22 GMT

HI ,

I need my Palo Alto to respond to ARP requests as if it were the owner of both the specified IP address and hardware address.

My ASA was able to do it, can't figure out how to do it with Palo Alto.

Thanks

Marianne

Raido_Rattameister — Wed, 27 Sep 2023 17:01:40 GMT

Destination NAT rules make Palo to perform Proxy ARP.

A bit clumsy solution but following would work.

Let's assume that Palo interface IP is 10.0.0.1 but you want it to reply also on 10.0.0.2

Set up DNAT rule to translate .2 to .1

In this case Palo will start replying to ARP requests looking for .2

If you also add random service that won't be used (udp/123 in my case) then you can avoid Palo actually performing NAT for this traffic.

You can also add multiple IP addresses on Palo interface.

Assuming interface IP is 10.0.0.1/24 you can add 10.0.0.2/32 as secondary IP.

marianneogorman — Wed, 27 Sep 2023 19:57:42 GMT

thanks a million for the answer