topic Re: Disable ARP entry for outside interface in Panorama Discussions

Disable ARP entry for outside interface

rbabu0 — Sat, 05 Feb 2022 08:24:42 GMT

Hi Team,

As per the ISP request, I need to disable ARP entry for my palo alto outside interface. Please suggest me how to proceed.

Palo alto outside interface connected with ISP, as per their request we need to disable ARP entry on that interface. Please let us know how to disable. Its very urgent.

Re: Disable ARP entry for outside interface

PavelK — Sat, 05 Feb 2022 22:31:03 GMT

Thank you for the post @rbabu0

It is possible to clear an ARP entry by either of the below commands:

clear arp interface <name> ip <ip/netmask>
clear arp interface <name> mac <value>

or set static ARP entry to some dummy entry:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGrCAK

Other than this I can't think of a way to disable a single entry. Could you elaborate more on this request? What is the motivation to disable ARP entry?

Kind Regards

Pavel

Re: Disable ARP entry for outside interface

rbabu0 — Mon, 07 Feb 2022 05:08:42 GMT

Hi Pavel,

My ISP getting error message martian destination 0.0.0.0 from 1x.6x.x.2.

This ip address is our palo alto exit interface ip 1x.6x.x.2 ( also we have default route to this isp exit interface for internet access ). Hence to stop that martian error message isp requesting as to disable arp entry of my exit interface. Please advise to me its urgent.

Re: Disable ARP entry for outside interface

TomYoung — Mon, 07 Feb 2022 16:03:31 GMT

Hi @rbabu0 ,

A Martian packet is one that does not exist on planet Earth, e.g. non-routable. Looking at your error message it looks like 1x.6x.x.2 is an RFC1918 10/8 IP address, which is not routable on the Internet. To fix this issue, find out what traffic is not being NATed to your public IP, and create a NAT rule for it.

Thanks,

Tom

Re: Disable ARP entry for outside interface

rbabu0 — Tue, 08 Feb 2022 00:00:34 GMT

1x.6x.x.2 is public ip, only.

Our Palo end 1x.6x.x.2 <-->1x.6x.x.1 ISP end

We have a default route to ISP.

Re: Disable ARP entry for outside interface

TomYoung — Tue, 08 Feb 2022 16:42:04 GMT

Hi @rbabu0 ,

So the 1x.6x.x.2 IP address is not 10.6x.x.2?

Thanks,

Tom