topic Arp getting time out after 30 min on sub interface in General Topics

Arp getting time out after 30 min on sub interface

Roby_Sreejith — Thu, 31 May 2018 13:00:50 GMT

We are facing some starnge issue .

We are having an ISP which is connected to sub interface.

We are trying to repalce it with new one. Same Subnet /29 but different IP. NAT rules also same because same subnet.

The issue we are facing is when new ISP configured , we are getting the ARP entries for ISP gateway on Palo Alto Sub interface however its expiring after 30 min which is normal arp interval.

After 30 min ARP is not learning.

I tried clearing arp. No success.

Last I tried manually configured static ARP on sub interface and Now The sub interface can reach the gateway IP now.

It seems after 30 min interval the Palo Alto is not trying to send the ARP request.

However when I connect my old ISP back it works perfectly. Does some one face similiar issues

Re: Arp getting time out after 30 min on sub interface

jvalentine — Thu, 31 May 2018 22:25:08 GMT

I would double-check your source-NAT policy. When I've seen this happen, it's been because the source-NAT address was inadvertently configured as a subnet entry (x.x.x.x/yy) instead of a single IP address (x.x.x.x). If you include the CIDR mask along with the address, the firewall will think it owns all of the IP addresses in that subnet, including your ISP's address.

Re: Arp getting time out after 30 min on sub interface

Roby_Sreejith — Fri, 01 Jun 2018 07:33:27 GMT

I have done debug logs and I could not see ant NAT translation logs.

Also Immeditaly, once i connect to different ISP it works fine.

For this new ISP ,it learns ARP dynamically for first time. But after 30 min it expires then it never learns.

Also if you configure static arp in Palo Alto sub interface it works fine

Re: Arp getting time out after 30 min on sub interface

Roby_Sreejith — Fri, 01 Jun 2018 14:42:50 GMT

What will happen when arp expire after 30 min. I could not see palo alto sending arp towards ISP