Cisco ASA allowed Arp alias , can Paloalto do arp alias?

[marianneogorman]

HI ,

I need my Palo Alto to respond to ARP requests as if it were the owner of both the specified IP address and hardware address.

My ASA was able to do it, can't figure out how to do it with Palo Alto.

Thanks

Marianne 

[Raido_Rattameister · Accepted solution]

Destination NAT rules make Palo to perform Proxy ARP.

A bit clumsy solution but following would work.

Let's assume that Palo interface IP is 10.0.0.1 but you want it to reply also on 10.0.0.2

Set up DNAT rule to translate .2 to .1

In this case Palo will start replying to ARP requests looking for .2

If you also add random service that won't be used (udp/123 in my case) then you can avoid Palo actually performing NAT for this traffic.

You can also add multiple IP addresses on Palo interface.

Assuming interface IP is 10.0.0.1/24 you can add 10.0.0.2/32 as secondary IP.

[marianneogorman]

thanks a million for the answer