topic Re: How to list arp table and identify network devices with mac under Check Point FWs in General Topics

How to list arp table and identify network devices with mac under Check Point FWs

Taner — Tue, 31 Aug 2021 21:30:30 GMT

Hello Check Point community,

I am faced with a specific issue.
Few networks and subnets are directly migrated to Check Point FWs.
The layer 3 interfaces are directly defined on the Check Point FWs.
And now for all hosts under these networks under CP, I can't see arp table and mac table, and I am not able to identify the devices under these networks.

In a scenario where the Layer 3 IP of the networks are defined under core switch, everything is clear and I can identify everything.

I think about NeDi – Find IT.
Do you have experience with NeDi – Find IT and Check Point FWs?
If we connect Nedi to Checkpoint with SNMP can Nedi find information about hosts and machines under subnets with L3 Gw defined under CP?

Thank you in advance.
Best Regards.

Re: How to list arp table and identify network devices with mac under Check Point FWs

PhoneBoy — Tue, 31 Aug 2021 23:54:59 GMT

I'm pretty sure the arp table is not something we make available via SNMP.
That said, you can always make a custom OID that provides this information: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk90860
Whether it can be processed by NeDi is a separate question.

Re: How to list arp table and identify network devices with mac under Check Point FWs

michaelhd — Fri, 22 Oct 2021 20:56:19 GMT

Hi, I have the same problem, and I can't find the section in the linked kb to do this. Is there a more specific instruction?

thank you.

Re: How to list arp table and identify network devices with mac under Check Point FWs

Chris_Atkinson — Sat, 23 Oct 2021 00:46:18 GMT

(IV-6) Advanced SNMP configuration - Extend SNMP with shell script

Further hints:

show arp dynamic all

-or-

arp -a

Re: How to list arp table and identify network devices with mac under Check Point FWs

Lubomir_Cerny — Fri, 15 Aug 2025 07:49:26 GMT

I have found that there is OID .1.3.6.1.2.1.4.35.1.4 on R81.20 which returns arp table from FW. Result from snmpwalk looks like:

IP-MIB::ipNetToPhysicalPhysAddress.29.ipv4."10.x.x.x" = STRING: cc:15:31:17:b1:e6
IP-MIB::ipNetToPhysicalPhysAddress.31.ipv4."10.x.x.x" = STRING: 0:50:aa:4f:26:59

Works also on SMB Spark boxes with R81.10.x

Maybe it will help someone 🙂