topic Re: Know Deferent fw ctl arp and arp command in Firewall and Security Management

Know Deferent fw ctl arp and arp command

Duminda_lakmal — Thu, 05 Jan 2023 04:45:18 GMT

Hi,

I have general questions about the below,

we have enabled Object Static NAT for one internal server to access the internet and expose the internet internal services, not added proxy ARP and arp.local manual file.

when I put fw ctl arp

I can see NAT public IP and MAC in the list. its okay to show as normal.

but when i put expert mode #arp, it's showing incomplete.

we have configured more than 10 Objects the same as that (static object nat), but #arp only shows this incomplete entry.

Kindly share your knowledge to understand, what is the deferent why it's incomplete.

Thank you,

Duminda Lakmal.

Re: Know Deferent fw ctl arp and arp command

Chris_Atkinson — Thu, 05 Jan 2023 12:18:00 GMT

Is this a single gateway or cluster and are you running the commands on the active member?

Which gateway version and is the NAT working or not?

Re: Know Deferent fw ctl arp and arp command

Duminda_lakmal — Thu, 05 Jan 2023 06:41:08 GMT

Yes. This is Cluster. I ran this on Active Gateway.

Re: Know Deferent fw ctl arp and arp command

Duminda_lakmal — Fri, 06 Jan 2023 13:06:46 GMT

This is R80.20, NAT working fine. This is for my knowledge.

Re: Know Deferent fw ctl arp and arp command

Chris_Atkinson — Fri, 06 Jan 2023 13:25:43 GMT

In early R80.20 JHF there were cosmetic differences between some ARP commands but not of this nature (sk112753).

Is this JHF T190 or higher?

Take 190 - Released on 28 February 2021 and declared as General Availability on 12 April 2021

PRJ-21242,PRHF-12746

Security Gateway: In rare scenarios, proxy ARP entries may be deleted when installing a policy.

Take 187 - Released on 17 November 2020

PRJ-13693,PMTR-55510

Security Gateway: Proxy arp change is applied only after the second policy installation.

*Note: R80.20 is End of Support and upgrading is recommended.

Re: Know Deferent fw ctl arp and arp command

Bob_Zimmerman — Fri, 06 Jan 2023 17:44:39 GMT

If I'm understanding your description correctly, this is expected behavior. The firewall won't get its own ARP requests, so it won't respond to itself.

Normally, the firewall shouldn't be talking to an address which it translates. It should talk to the real address. What are you trying to do?

Re: Know Deferent fw ctl arp and arp command

Chris_Atkinson — Fri, 06 Jan 2023 22:52:52 GMT

I assume the OP is trying to follow the likes of sk30197 which states:

To display the ARP Proxy table entries on the Security Gateway, use these commands in Expert mode:

[Expert@HostName:0]# fw ctl arp

[Expert@HostName:0]# fw ctl arp -n

[Expert@HostName:0]# arp -a

[Expert@HostName:0]# arp -e

Re: Know Deferent fw ctl arp and arp command

the_rock — Sat, 07 Jan 2023 01:18:02 GMT

Thanks for pointing out all of them, I just always did fw ctl arp.

Re: Know Deferent fw ctl arp and arp command

Duminda_lakmal — Mon, 09 Jan 2023 17:13:17 GMT

Thanks a lot for the clarification.