Disable ARP entry for outside interface

[rbabu0]

Hi Team,

As per the ISP request, I need to disable ARP entry for my palo alto outside interface. Please suggest me how to proceed.

Palo alto outside interface connected with ISP, as per their request we need to disable ARP entry on that interface. Please let us know how to disable. Its very urgent.

[PavelK]

Thank you for the post @rbabu0

It is possible to clear an ARP entry by either of the below commands:

clear arp interface <name> ip <ip/netmask>
clear arp interface <name> mac <value>

or set static ARP entry to some dummy entry:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGrCAK

Other than this I can't think of a way to disable a single entry. Could you elaborate more on this request? What is the motivation to disable ARP entry?

Kind Regards

Pavel

[rbabu0]

Hi Pavel,

My ISP getting error message martian destination 0.0.0.0 from 1x.6x.x.2.

This ip address is our palo alto exit interface ip 1x.6x.x.2  ( also we have default route to this isp exit interface for internet access ). Hence to stop that martian error message isp requesting as to disable arp entry of my exit interface. Please advise to me its urgent.

[TomYoung]

Hi @rbabu0 ,

A Martian packet is one that does not exist on planet Earth, e.g. non-routable.  Looking at your error message it looks like 1x.6x.x.2 is an RFC1918 10/8 IP address, which is not routable on the Internet.  To fix this issue, find out what traffic is not being NATed to your public IP, and create a NAT rule for it.

Thanks,

Tom

[rbabu0]

Hi

1x.6x.x.2 is public ip, only. 

Our Palo end 1x.6x.x.2  <-->1x.6x.x.1 ISP end

We have a default route to ISP.

[TomYoung]

Hi @rbabu0 ,

So the 1x.6x.x.2 IP address is not 10.6x.x.2?

Thanks,

Tom