- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
04-15-2025 11:20 AM - edited 04-15-2025 11:43 AM
Hello all!
I'm facing an issue which brings me to ask what the proper configuration should be for an outside interface.
Given the attached diagram and captures, do I have the correct outside interface (vlan.100) configuration?
diagram
Outbound traffic is not reaching Internet because the ARP entry for the default gateway (194.204.1.1) is incomplete in the firewall.
arp-incomplete
I think that is happening because the firewall is sourcing its ARP requests with the network IP (194.204.1.0).
capture
Is that because of my outside interface configuration?
Thanks!
04-15-2025 12:36 PM
Hello,
Either way would work, I usually go with the /32 myself for preference. Or you can just put the IP and no subnet mask.
Regards,
04-15-2025 11:44 AM
Hello,
The only weird thing I saw was that you have 194.204.1.0/26 as an IP address (which its not). However check the routing as well to make sure 0.0.0.0/0 is going to 192.204.1.1 and internal traffic is going to the respective vlan. The traffic logs should show if the traffic is allowed etc.
Regards,
04-15-2025 12:01 PM
...you have 194.204.1.0/26 as an IP address...
Thank you for pointing that out, I inherited this configuration and couldn't understand why that is there, unless to make sure that the firewall will claim (from an ARP standpoint) all addresses in the 194.204.1.0/26 range. For instance, when the upstream router wants to deliver a packet for 194.204.1.10, it will ask "Who has 194.204.1.10?", and I thought this part of the interface configuration was responsible for making sure that the firewall replies "I am 194.204.1.10" without having to list all the addresses in that subnet.
04-15-2025 12:05 PM
Hello,
Just add the IP's of NAT policies to the interface is the ARP is send etc. Per your config they would be: 194.204.1.6, 194.204.1.10, and 194.204.1.11
Regards,
04-15-2025 12:32 PM
Just add the IP's of NAT policies to the interface...
Ok, like this?
194.204.1.6/26
194.204.1.10/26
194.204.1.11/26
Or should the subnet masks be /32?
04-15-2025 12:36 PM
Hello,
Either way would work, I usually go with the /32 myself for preference. Or you can just put the IP and no subnet mask.
Regards,
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!