Eve-NG Palo Alto VM ARP Issue

[f.kuecuek]

Does anybody encounter arp problems in eve-ng on palo firewall with pan-os 11 version ?  As an example, i have a small topology like clientA->routerA-> firewall<-routerB<-clientB , when i try to ping from clientA to clientB, clientA send ARP Request for clientB however firewall does not reply ARP Reqest... (it is not a policy,routing or config issue) i believe something can be wrong with my firewall image. (if clients direcly conneted to firewall without routers then it works)

Has anybody notice such a thing ?

Thanks in advance 

[seb_rupik]

Hi there, 

If the clients are ARP'ing for eachother, are they in the same subnet?

It might be useful to share the IP setup of your topology.

cheers,

Seb.

[f.kuecuek]

vpc1 : 192.168.102.10/24  (gateway 192.168.102.1 on router)
eth0/2 : 192.168.102.1/24
eth0/1 : 192.168.101.1/24
firewall eth1/1 : 192.168.101.10/24
firewall eth1/2 : 172.16.1.2/24
vpc2 : 172.16.1.99/24  (gateway 172.16.1.2 on firewall)

From VPC1 and Router i can ping firewall interface eth1/1
From VPC2 i can ping firewall itnerface eth1/2

However from VPC1 i can not ping VPC2, even though there is route for network 192.168.102.0/24 on firewall default virtual router exist. It does not reply ARP Reqest packets comes from Router ( started ping from VPC1)

[seb_rupik]

Hi there,

If VPC1 is ARP'ing for VPC2 it must think it is in the same subnet. A IP stack should be able to look at its own IP configuration and that of the destination and determine via subnet ID and netmask if the destination is in the same subnet (ARP is the correct response here) or if not ARP for the local gateway and have its packet routed via the gateway to the destination.

I would double check the netmasks you have configured on the VPC1 side of the network. Also confirm that the IOS router does not have proxy-ARP enabled on its interfaces.

cheers,

Seb.