topic Re: ARP table cache "incomplete" in General Topics

ARP table cache "incomplete"

TranceforLife — Wed, 23 Nov 2016 18:33:03 GMT

Hello All,

Need some clarification on ARP table. For some reason, once we swapped the devices from 2020>3020 our ARP table is seen as incomplete but services are working fine withing on that particular external subnet (before they did but we use gratuitous arp) . Also the time out of the "incomplete" entries pretty much a second ( ttl =1):

Cheers,

Myky

Re: ARP table cache "incomplete"

santonic — Thu, 24 Nov 2016 07:21:45 GMT

Incomplete means that PA didn't get ARP reply to his ARP query.

Or in other words there are no devices with those IPs in the network configured on this interface.

Re: ARP table cache "incomplete"

TranceforLife — Thu, 24 Nov 2016 08:09:42 GMT

Hi,

Thanks! l cannot understand how then it is working:

Let's say on .77 IP we got web server hosted on premise where 1x1 NAT is configured for outside host when they hitting .77

So essentially for half of these IPs 1x1 NAT is in place .126 is a default gateway where .122 is a test PC.

Another thing when l send a gratuitous ARP how the Palo decides to which host to send. Why l don't see other IP, as we got /26 for outside? Palo must know that these are alive

Re: ARP table cache "incomplete"

santonic — Thu, 24 Nov 2016 08:23:59 GMT

Ahh, those are IPs used for DNAT on PA?

PA doesn't need those in its table. But he replies to other devices with its MAC address for them. So if you look ARP tables on surrounding devices you will see entries for those IPs with PA mac address.

Why are they in the PA table and displayed as incomplete I don't know.

Re: ARP table cache "incomplete"

TranceforLife — Thu, 24 Nov 2016 17:17:57 GMT

Hi,

This is the very good point! So if the DNAT configured for the 86.xx.xx.72, 86.xx.xx.77 etc PA will reply for the ARP request.

That is why when we changed a PA to the new one, old ARP cache ( old PA MAC address) still was present in ARP table of external DG withing the same subnet, hence no services we available as DG had wrong MAC for these IPs. Will confirm ARP table on the test PC and let you know.

Cheers,

Myky