What happens when the return-mac limit is reached when using symmetric routing?

[alowther_chatham]

Does anybody know what happens if the limit is reached on the return-mac table? 

We have multiple ISPs and can host services on each if we use a PBF rule using symmetric return.  However, there is a limit and I can't find any information about what happens when the limit is reached.

The admin guide just says

To determine the next hop for symmetric returns, the firewall uses an Address Resolution Protocol
(ARP) table. The maximum number of entries that this ARP table supports is limited by the firewall
model and the value is not user configurable. To determine the limit for your model, use the CLI
command: show pbf return-mac all.

[reaper · Accepted solution]

Hi

Once the mac table is full no new mac addresses can be resolved until space becomes available for new entries. Any sessions needing a mac to get resolved for the symmetric-return would get dropped due to the inability to resolve the mac of the destination IP

hope this helps

Tom