topic Re: Causing change in ARP Table Entry (PAN-OS 5.0.8) in General Topics

Causing change in ARP Table Entry (PAN-OS 5.0.8)

Art — Thu, 20 Feb 2014 22:16:02 GMT

Hello Everyone,

One of our Application Support Teams were trying to move from using servers being an ACE to servers behind a NetScaler last night... as part of the ensuing situation I was asked to check and if necessary clear the ARP Table on the PANs (PA-5060's running 5.0.8 in HA Failover)...

So, I hop on the active PAN and do a 'show arp all' and got these results
ae2.109 w.x.y.z 00:0b:fc:fe:1b:02 ae2 c 756 (results somewhat redacted)

I asked and was told the ARP Table should be showing a MAC address of 'x:y:z:d:b:4f:77' (don't remember all the values :S)

I was asked to clear the ARP Table to see if that would clear things up and get to what they needed.

'Clear all arp' was issued... but the value didn't change...

I found Bug #54000 (see below) in 5.0.9's release notes... but this isn't quite the situation....

• 54000—The ARP entries associated with a Layer 2 interface that is a part of a Layer 3

VLAN interface were not cleared from the ARP table when the Layer 2 interface went down.

Anyone encountered this type of thing before?

Thanks

Art

Re: Causing change in ARP Table Entry (PAN-OS 5.0.8)

pulukas — Fri, 21 Feb 2014 21:30:28 GMT

This does sound like a bug.

You could also try to clear the arp by interface instead of globally.

clear arp ethernet1/1

Re: Causing change in ARP Table Entry (PAN-OS 5.0.8)

Art — Mon, 24 Feb 2014 21:29:35 GMT

Thanks for the help and the suggestion... I had actually started by clearing only a specific interface for fear of what might break (in the infrastructure not the PANs ) with the clear arp all command.

I will call Tech Support for guidance/help

thanks

Art

Re: Causing change in ARP Table Entry (PAN-OS 5.0.8)

ericgearhart — Tue, 25 Feb 2014 14:18:06 GMT

Also this is kind of a "side solution" to your main problem, but if the ACEs can send a gratuitous ARP out when the failover happens the PAN firewalls should honor that gratuitous ARP and immediately update their tables. In theory.