Duplicate Address Detection (DAD)/Gratuitous ARP

santonic — Wed, 09 Jan 2013 07:59:40 GMT

hi!

I was wondering if a PAN firewall performs Duplicate Address Detection (DAD) by sending ARP Request packets for IP addresses on an interface once it is connected to a switch? does it do it only for the primary address on an interface or does it do it for all the IP addresses that are configured as aliases on an interface?

we have noticed that if we replace a malfunctioning firewall with an on-site spare unit, that has the exact same configuration but a different MAC address on the internet interface, we are unable to use all the addresses that are configured as aliases on that interface. once the ARP cache on the provider router times out (by default on a Cisco device it takes 4 hours) and the binding between MAC and IP addresses is refreshed, all the connectivity problems are resolved.

cheers,

Andrej

Re: Duplicate Address Detection (DAD)/Gratuitous ARP

nbilly — Wed, 09 Jan 2013 11:41:47 GMT

Hi Andrej,

Nothing special is sent when an interface comes up.

Gartuitous Arp will be sent over every interfaces (including subint) but only in HA mode and only during a commit or a failover.

Best Regards

-Nicolas

topic Re: Duplicate Address Detection (DAD)/Gratuitous ARP in General Topics

Duplicate Address Detection (DAD)/Gratuitous ARP

Re: Duplicate Address Detection (DAD)/Gratuitous ARP