PA500 arp cache limit reached - any ideas?

[mstevenson]

Hi

I have 2 PA500 firewalls running in a active/passive HA setup, the firewalls are fully integrated into active directory using the Identification client for security polices all clients on the network are set to use our core switch as their default gateway and the switch has a route set so it uses the firewalls IP as its gateway. Problem is the PA500 has a hard limit of 500 ARP table entries and we have a lot more than 500 network devices on the network, so when the firewall reaches its 500 ARP limit no more devices can connect to the internet, the only way i have found to try and allow other clients is to clear the ARP tables on the firewalls, but this causes other clients to have no internet connectivity. Does anyone have any ideas on how i can resolve this without upgrading to the larger firewalls?

Thanks

Matt

[UhMayYeah]

Check the Destination NAT rules ,if they have been configured with the entire subnet.

Try removing the interfaces from the static route config just keeping the next-hop as IP address.

-Ameya