topic Re: ARP Table Cleanup. in Firewall and Security Management

ARP Table Cleanup.

Matlu — Sun, 29 Oct 2023 21:11:16 GMT

Hello,

Is it possible to do a "cleaning" of the ARP table, in a GW Check Point (using the CLI, maybe)?

I have a problem with a web service posting using port 443.

The eth3 interface of our GW has the public pool 190.187.181.x/26

From that pool we are taking a free IP, and making a publication, but the service is not working.

We have "added" an entry in the Proxy ARP, to announce to the Router above, that we have the Public IP that we are using to publish, however, the service does not work, and it seems to be a problem with the ARP table.

We want to try doing a cleanup of this table. Is it possible?

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth3, link-type EN10MB (Ethernet), capture size 262144 bytes
12:40:48.771135 ARP, Request who-has 190.187.181.202 tell 190.187.181.253, length 46
12:40:50.769658 ARP, Request who-has 190.187.181.202 tell 190.187.181.253, length 46
12:40:55.767368 ARP, Request who-has 190.187.181.202 tell 190.187.181.253, length 46
12:41:03.825759 ARP, Request who-has 190.187.181.202 tell 190.187.181.253, length 46
12:41:10.849822 ARP, Request who-has 190.187.181.202 tell 190.187.181.253, length 46
12:41:17.843988 ARP, Request who-has 190.187.181.202 tell 190.187.181.253, length 46

Greetings.

Re: ARP Table Cleanup.

Chris_Atkinson — Mon, 30 Oct 2023 10:48:37 GMT

What do the following commands tell you about the new entry?

[Expert@HostName:0]# fw ctl arp

[Expert@HostName:0]# fw ctl arp -n

[Expert@HostName:0]# arp -a

[Expert@HostName:0]# arp -e

Re: ARP Table Cleanup.

Matlu — Mon, 30 Oct 2023 13:09:21 GMT

Hello,

These commands show me all the IPs we are using to publish services, for example:

x.x.x.198
x.x.x.199

The strange thing is that it does not "show" the x.x.x.202, which is the new IP that we have used for a publication.

But this IP is already added correctly in the Proxy ARP.

Re: ARP Table Cleanup.

Chris_Atkinson — Mon, 30 Oct 2023 13:34:44 GMT

Which order did you do things (config wise), have you tried installing policy again since?

Re: ARP Table Cleanup.

Matlu — Mon, 30 Oct 2023 13:55:15 GMT

Hello,

I have retrying the installation of policies, and now the public x.x.x.202 appears in the list of "fw ctl arp -n".

I have the impression that in the first installation I did, it was not applied correctly.

Thanks for the suggestion.