ARP timeout

[ldormond]

Hello,

We have a customer who is facing issue described by this KB article :

I wonder whether it is possible to change the default timeout value which is set to 1800 seconds ?

It could be very helpfull in some situations, and most of the network devices allow to change this value.

I searched the Admin guide and CLI guide as well as the KB but I didn't find anything concerning this point.

Regards,

Laurent

[mikand]

According to these threads it seems that the value if 1800 seconds is hardcoded and cannot be changed.

Hopefully you can issue this as a feature request (given that this "hardcoded" isnt burned into the NPU's being used):

[ldormond]

Thanks for your answer.

I read that PanOS 5.0.1 has implemented an increased ARP table. This could helps in some situations.

Regards

[mikand]

Another workaround could be to put a L3 device (L3 switch or such) in front of your PA and setup a linknet between this L3 device and the PA box.

Like so:

PA <- 10.0.0.1/30, 10.0.0.2/30 -> L3-device <- 192.168.255.254/16

This way the PA box only see one mac, the mac of 10.0.0.2 (or whatever ip you setup). While the L3-device takes the hit regarding shitloads of clients vs. mac-addresses.