Status Incomplete

[Davevanwijck]

Hello,

what does this mean and how to solve it?

When doing an show arp all:

No MAC is displayed at an IP address.

Any help is welcome, thanks in advance 🙂

[S.Cantwell]

Incomplete means that the OTHER side did not offer its mac address when the FW attempted to do an arp.

How to fix?  Determine why the other side didnt respond back.

Do a packet capture to confirm that the other side did or did not respond.

This may not be a FW issue.

Thanks

[reaper]

Arp is for layer 3, mac is for layer2

Since you have vlan interfaces, you need to look up the mac table

> show mac all

[Davevanwijck]

Show mac all does not display the MAC address we expect.
Weird thing is, the arp table was ok a while ago.

But suddenly it did not display the MAC address, but still the IP address is visable without a MAC.

[reaper · Accepted solution]

in that case (there's a L3 vlan interface) @S.Cantwell s explanation holds:

the firewall attempted to reach out to the IP and did not receive a reply from the 'owner' either because it is not there, or the device is unable to respond

[Davevanwijck]

Yes, that is what I thought as well. But why isn't the table being refreshed automatic after a certain time?

I would expect that this entry would be deleted after the TTL?

(The device is still connected, but the MAC address is gone. Maybe device is defect, but not sure yet.

We are busy with further troubleshooting.)

[S.Cantwell · Accepted solution]

Is it possible that there are devices that are still attempting to reach out to the device?

Have you removed the device IP from any virtual router configurations (if that was a next hop)

As long as devices on the network are attempting to communicate to or through the device, then the FW may continue to show.

You can always do a "clear arp all" to clear the table.