topic ARP refresh in firewall if replacing the connected device in General Topics

ARP refresh in firewall if replacing the connected device

Deepak25 — Tue, 16 Jan 2024 17:17:39 GMT

we are changing the core device hardware connected to Palo alto firewall inside interface. To minimize downtime we will be moving inside interface of secondary passive firewall to new secondary core and then we will make it active by suspending primary firewall.

Is there any ARP issue or delay in arp refresh on Secondary firewall as we will live the connectivity with new core device which will have new mac.?

Re: ARP refresh in firewall if replacing the connected device

jpomachagua — Tue, 16 Jan 2024 18:41:28 GMT

Hello @Deepak25

To minimize any potential impact from the upcoming change, please consider the following steps:

Ensure that any static routes, PBF policies, or NAT policies are configured by IP address rather than interface, as the interface in the secondary firewall will be different.
After suspending the primary firewall, clear the ARP table on the old inside interface.

Lastly, the ARP refresh is really fast and there should not be any significant delay.