topic Status Incomplete in General Topics

Status Incomplete

Davevanwijck — Tue, 01 Dec 2020 10:04:15 GMT

Hello,

what does this mean and how to solve it?

When doing an show arp all:

No MAC is displayed at an IP address.

Any help is welcome, thanks in advance 🙂

Re: Status Incomplete

S.Cantwell — Tue, 01 Dec 2020 22:45:23 GMT

Incomplete means that the OTHER side did not offer its mac address when the FW attempted to do an arp.

How to fix? Determine why the other side didnt respond back.

Do a packet capture to confirm that the other side did or did not respond.

This may not be a FW issue.

Thanks

Re: Status Incomplete

reaper — Tue, 01 Dec 2020 23:42:29 GMT

Arp is for layer 3, mac is for layer2

Since you have vlan interfaces, you need to look up the mac table

> show mac all

Re: Status Incomplete

Davevanwijck — Wed, 02 Dec 2020 08:16:35 GMT

Show mac all does not display the MAC address we expect.
Weird thing is, the arp table was ok a while ago.

But suddenly it did not display the MAC address, but still the IP address is visable without a MAC.

Re: Status Incomplete

reaper — Wed, 02 Dec 2020 08:30:04 GMT

in that case (there's a L3 vlan interface) @S.Cantwell s explanation holds:

the firewall attempted to reach out to the IP and did not receive a reply from the 'owner' either because it is not there, or the device is unable to respond

Re: Status Incomplete

Davevanwijck — Wed, 02 Dec 2020 10:21:24 GMT

Yes, that is what I thought as well. But why isn't the table being refreshed automatic after a certain time?

I would expect that this entry would be deleted after the TTL?

(The device is still connected, but the MAC address is gone. Maybe device is defect, but not sure yet.

We are busy with further troubleshooting.)

Re: Status Incomplete

S.Cantwell — Wed, 02 Dec 2020 13:44:56 GMT

Is it possible that there are devices that are still attempting to reach out to the device?

Have you removed the device IP from any virtual router configurations (if that was a next hop)

As long as devices on the network are attempting to communicate to or through the device, then the FW may continue to show.

You can always do a "clear arp all" to clear the table.