topic Re: With out ARP entry internet is not working. in General Topics

With out ARP entry internet is not working.

Satish — Mon, 01 Sep 2014 11:21:00 GMT

Dear Friends,

I have 2 interfaces in PAN->lan zone and internet zone

ISP router-huawei mac is not learned in palo alto firewall..As a result, Internet not working

But when i add static ARP entry for huawei router in ISP interface, Internet is working fine.

Please suggest to me.Thanks

Regards

Satish

Re: With out ARP entry internet is not working.

reaper — Mon, 01 Sep 2014 11:36:26 GMT

Hi Satish

could you share parts of your config? especially interesting is the configuration of the interfaces and the virtual router + the output of > show routing route and > show arp all

one thing that comes to mind is taht there could be a subnet mismatch between the interface and the IP of the default gateway eg if: 10.0.0.1/25 dg: 10.0.0.254 , this could cause such issue

Re: With out ARP entry internet is not working.

ajbool — Mon, 01 Sep 2014 11:36:44 GMT

Mis-matched network masks configure on the PAN and Huawei devices perhaps?

Re: With out ARP entry internet is not working.

Satish — Mon, 01 Sep 2014 11:46:02 GMT

Hi Tpiens,

Thanks for your reply but i have done the following things:

Disable/delete Source-Nat dynamic and port translated address Policy

Clear session

Ping source internet ip host 4.2.2.2

Then check all of the possible issues noted in this document: https://live.paloaltonetworks.com/docs/DOC-7571

I can't able to findout why it happen...Please suggest.

Re: With out ARP entry internet is not working.

Satish — Mon, 01 Sep 2014 11:47:44 GMT

Hi Ajbool,

Thanks for reply but both device config is same.

Regards

Satish

Re: With out ARP entry internet is not working.

reaper — Mon, 01 Sep 2014 12:07:35 GMT

Hi Satish

can you get the output of:

> show routing route

> show interface all

> show arp all

Re: With out ARP entry internet is not working.

HULK — Mon, 01 Sep 2014 12:16:53 GMT

Hello Satish,

Try to find out 2 possibilities here.

1-- PAN is sending the ARP request, but the ISP router is not responding back. You can take a packet capture on the PAN firewall. Ref DOC: How To Capture ARP Packets on an Interface

2-- PAN FW itself is not sending the ARP broadcast mesage. In this situation, you can forecefully send a Gratuitous ARP (GARP) message to update an ARP table of the ISP routers ARP table. Ref DOC: Trigger a Gratuitous ARP (GARP) from a Palo Alto Networks Device

Hope this helps.

Thanks

Re: With out ARP entry internet is not working.

Satish — Mon, 01 Sep 2014 12:27:17 GMT

Thanks Dud.. Let me check and i will come back to you. Regards Satish