topic Re: Manual NAT with proxy ARP fails randomly in Firewall and Security Management

Manual NAT with proxy ARP fails randomly

Alex_Lillo — Thu, 29 Aug 2019 08:35:21 GMT

Hi mates,

We are dealing with another strange issue, where a published NAT stops working randomly after a policy install.

The rule works as expected, the proxy ARP entry is in place, and after changing something completely unrelated (i.e. enabling a protection from staging to prevent), the NAT entry stops working.

Sometimes is one NAT rule, sometimes is another.

We are cleaning up our NAT rulebase (currently 377 NAT rules, aproximatedly 40% had already been disabled) just to deal with this and clean things up.

Has somebody found this problem before?

Re: Manual NAT with proxy ARP fails randomly

Maarten_Sjouw — Thu, 29 Aug 2019 08:39:52 GMT

Just a few simple questions:
Which version is on the gateway, which jumbo?
Are you using VMAC in clustering? ClusterXL or VRRP?
In the proxy arp command are you referring to the interface or the mac address?
When it does not work, what does 'fw ctl arp' tell you, is it really gone?

Re: Manual NAT with proxy ARP fails randomly

Alex_Lillo — Thu, 29 Aug 2019 10:57:48 GMT

R80.10 jumbo Take 203

Cluster XL & VMAC

I'm referring to both the IP and the MAC address, using fw ctl arp. It's in place.

Re: Manual NAT with proxy ARP fails randomly

Alex_Lillo — Thu, 29 Aug 2019 11:02:52 GMT

UPDATE: When launching "clusterXL_admin down && clusterXL_admin up" from active member, passive member becomes ACTIVE and the NAT rule starts working again. If you fail back again, the NAT rule still does not work.

With cpstop && cpstart on failing member, it starts working normally.

Re: Manual NAT with proxy ARP fails randomly

Maarten_Sjouw — Thu, 29 Aug 2019 11:03:03 GMT

Are you using VMAC?
So the command you are using:
add arp proxy ipv4-address 123.123.123.125 macaddress 00:1c:7f:38:22:fe real-ip 123.123.123.123
Where real-ip is the ip of the member, not the VIP and the macaddress is the VMAC when using VMAC.

Re: Manual NAT with proxy ARP fails randomly

Maarten_Sjouw — Thu, 29 Aug 2019 11:12:48 GMT

This sounds like you need to open a TAC case and involve @Ilya_Yusupov with this issue.

Re: Manual NAT with proxy ARP fails randomly

Alex_Lillo — Thu, 29 Aug 2019 11:15:10 GMT

Exactly, that's it.

Re: Manual NAT with proxy ARP fails randomly

Timothy_Hall — Thu, 29 Aug 2019 15:58:21 GMT

Sounds an awful lot like this (sk154092 - Security Gateway loses Proxy ARP entries after policy installation), for which there is a hotfix available:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk154092