Why would an active firewall in an active-passive HA configuration broadcast gratuitous ARPs every 60 seconds?

[A.Leung514385]

I found a KB article stating that the active firewall sends out gratuitous ARPs every 60 seconds during normal operation, but it doesn't explain why. What is the reason for this behaviour?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004Ny3CAE

[oliwer96pety]

In an active–passive high availability firewall setup, the active firewall may broadcast gratuitous ARPs every 60 seconds as a way to continuously assert its ownership of the virtual IP address and keep network devices updated. Gratuitous ARP messages help ensure that switches, routers, and connected hosts maintain the correct MAC-to-IP mapping in their ARP tables, preventing stale or incorrect entries that could disrupt traffic flow. This periodic broadcasting is especially useful in environments where ARP table entries might age out or where there is a risk of failover events, as it reinforces network stability and minimizes packet loss or misrouting by reminding all devices that the active firewall is still responsible for handling traffic.

[kiwi]

Hi @A.Leung514385 ,

It is just way of telling the switch that the current active is still the one active (liveliness check), because switches have timer associated with the CAM entries.

Kind regards,

[A.Leung514385]

Hi @kiwi ,

Thanks for your response

Regards,