Question regarding ARP timeout

[dsulli99]

Hi,

I have a question regarding ARP caching and timeout on the Palo Alto platform.

Based on the output of the "show arp all" command, it looks as if the "default timeout" is 1800 seconds.  I am doing some work with failover for a cluster inside my firewall, and I wanted to know if there was persistent ARP caching such that a different MAC address can immediately begin ARPing for an IP that is cached on the firewall itself.   I have seen some environments where persistent ARP caching is implemented as security feature to resolve inadvertent IP address conflicts.  Is this sort of feature enabled on the Palo Alto platform?  Does anybody know if this is related to the ARP settings in the output of "show arp all"?  I basically want to make sure that my firewall is configured in a way that a new MAC address can immediately being ARPing for an IP address withouth having to flush a cache or waiting for a cached entry to expire (even if the expiration would occur after a few seconds).

I currently have the software version 4.1.6 installed on my cluster (I searched the admin guide for all occurrences of the word ARP and couldn't find the information I am looking for).  I appreciate any guidance you could provide in helping me answer this question.

Dan Sullivan

[dburns · Accepted solution]

The cache on the pan is not persistent. The ARP table will update accordingly. I tested it out and you do not have to flush the cache manually or wait for the time out, as expected.

Dominic