topic Re: standby mode ARP table? in Firewall and Security Management

standby mode ARP table?

jimmychuang — Mon, 28 Oct 2024 08:10:07 GMT

When the firewall is in standby mode, will it still actively clear the ARP table?

Re: standby mode ARP table?

AkosBakos — Mon, 28 Oct 2024 09:42:56 GMT

Could you clarify the question? Why do you mean about "clear the ARP table"

Re: standby mode ARP table?

PhoneBoy — Mon, 28 Oct 2024 13:30:32 GMT

ARP tables are not synchronized between cluster members, each node manages their own per the usual rules in Linux.

Re: standby mode ARP table?

jimmychuang — Tue, 29 Oct 2024 07:24:53 GMT

If Firewall A was originally active, but the cluster switched to standby for some reason, will the old entries in Firewall A's ARP table be automatically deleted, even though it won't acquire new MAC addresses?

Re: standby mode ARP table?

jimmychuang — Tue, 29 Oct 2024 08:01:20 GMT

I know this, but what I want to understand is whether ARP continues to function when the firewall is in standby mode. Will the old ARP tables be automatically deleted?

Re: standby mode ARP table?

PhoneBoy — Tue, 29 Oct 2024 17:17:03 GMT

As stated, each member manages their own ARP tables independently.
That includes purging out ARP entries that aren't used after a period of time (meaning no traffic has come from/to that particular IP).
Again, this occurs according to the standard Linux rules for this.

Re: standby mode ARP table?

JozkoMrkvicka — Tue, 29 Oct 2024 20:35:36 GMT

No, standby member will not delete ARP entries despite the fact that it should do it after timeout is reached (set arp timeout), by default 60 seconds.

Re: standby mode ARP table?

JozkoMrkvicka — Wed, 30 Oct 2024 09:57:32 GMT

Well, ARP cache entry topic is not as simple as one would think.

For much higher overview how ARP works, see THIS and THIS answers.