ARP table cache "incomplete"

[TranceforLife]

Hello All,

Need some clarification on ARP table. For some reason, once we swapped the devices from 2020>3020  our ARP table is seen as incomplete but services are working fine withing on that particular external subnet (before they did but we use gratuitous arp) . Also the time out of the "incomplete" entries pretty much a second ( ttl =1):

Cheers,

Myky

[santonic]

Incomplete means that PA didn't get ARP reply to his ARP query.

Or in other words there are no devices with those IPs in the network configured on this interface.

[TranceforLife]

Hi,

Thanks! l cannot understand how then it is working:

Let's say on .77 IP we got web server hosted on premise where 1x1 NAT is configured for outside host when they hitting .77

So essentially for half of these IPs 1x1 NAT is in place .126 is a default gateway where .122 is a test PC.

Another thing when l send a gratuitous ARP how the Palo decides to which host to send. Why l don't see other IP, as we got /26 for outside? Palo must know that these are alive 

[santonic · Accepted solution]

Ahh, those are IPs used for DNAT on PA?

PA doesn't need those in its table. But he replies to other devices with its MAC address for them. So if you look ARP tables on surrounding devices you will see entries for those IPs with PA mac address.

Why are they in the PA table and displayed as incomplete I don't know.

[TranceforLife]

Hi,

This is the very good point! So if the DNAT configured for the 86.xx.xx.72, 86.xx.xx.77 etc PA will reply for the ARP request. 

That is why when we changed a PA to the new one, old ARP cache ( old PA MAC address) still was present  in ARP table of external DG withing the same subnet, hence no services we available as DG had wrong MAC for these IPs. Will confirm ARP table on the test PC and let you know.

Cheers,

Myky