Disable ARP entry for outside interface

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Disable ARP entry for outside interface

L1 Bithead

Hi Team,

 

As per the ISP request, I need to disable ARP entry for my palo alto outside interface. Please suggest me how to proceed.

 

Palo alto outside interface connected with ISP, as per their request we need to disable ARP entry on that interface. Please let us know how to disable. Its very urgent.

5 REPLIES 5

Cyber Elite
Cyber Elite

Thank you for the post @rbabu0

 

It is possible to clear an ARP entry by either of the below commands:

 

clear arp interface <name> ip <ip/netmask>
clear arp interface <name> mac <value>

 

or set static ARP entry to some dummy entry:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGrCAK

 

Other than this I can't think of a way to disable a single entry. Could you elaborate more on this request? What is the motivation to disable ARP entry?

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hi Pavel,

 

My ISP getting error message martian destination 0.0.0.0 from 1x.6x.x.2.

 

This ip address is our palo alto exit interface ip 1x.6x.x.2  ( also we have default route to this isp exit interface for internet access ). Hence to stop that martian error message isp requesting as to disable arp entry of my exit interface. Please advise to me its urgent.

Cyber Elite
Cyber Elite

Hi @rbabu0 ,

 

A Martian packet is one that does not exist on planet Earth, e.g. non-routable.  Looking at your error message it looks like 1x.6x.x.2 is an RFC1918 10/8 IP address, which is not routable on the Internet.  To fix this issue, find out what traffic is not being NATed to your public IP, and create a NAT rule for it.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Hi

1x.6x.x.2 is public ip, only. 

 

Our Palo end 1x.6x.x.2  <-->1x.6x.x.1 ISP end

We have a default route to ISP.

Cyber Elite
Cyber Elite

Hi @rbabu0 ,

 

So the 1x.6x.x.2 IP address is not 10.6x.x.2?

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.
  • 3183 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!