topic Re: arp is not learning on SMB devcie in Spark Firewall (SMB)

arp is not learning on SMB devcie

Surendra — Fri, 13 Sep 2024 06:13:55 GMT

we have SMB device cluster which are managing by centrally.

OS version is R81.10.10

fw02 is getting arp entry with PERM
<ip> at <Mac address> [ether] PERM on LAN3

and fw01 firewall is not learning arp for the same ip

<ip address> at <incomplete> on LAN3

what ever firewall is active, fw01 is not learning arp for that ip on LAN3

please suggest the solution.

Re: arp is not learning on SMB devcie

Chris_Atkinson — Fri, 13 Sep 2024 08:36:52 GMT

What is LAN3 connecting to and how is that device configured / correct VLAN etc?

Is the Gateway providing DHCP for that segment or has a static arp entry been configured...

Re: arp is not learning on SMB devcie

Surendra — Fri, 13 Sep 2024 10:27:25 GMT

LAN3 is connecting to L2 switch on same VLAN which is fw02 is connected. from switch to destination device.

No DHCP, all are static ip address
no idea about static arp in SMB firewalls.

Re: arp is not learning on SMB devcie

G_W_Albrecht — Fri, 13 Sep 2024 10:58:43 GMT

sk114531: Configuring Proxy ARP for Manual Static NAT on Quantum Spark appliances

sk177763: Best Practices - How to manage multiple Quantum Spark Appliances (SMB) Security Gateways

Re: arp is not learning on SMB devcie

PhoneBoy — Fri, 13 Sep 2024 15:26:16 GMT

A diagram showing the physical/logical connectivity between fw01, fw02, and the relevant host will be helpful here.

Re: arp is not learning on SMB devcie

Lesley — Fri, 13 Sep 2024 17:40:25 GMT

tcpdump will show the issue:

tcpdump -nni LAN3 host <IP>

tcpdump -nni any host <IP>

You will see broadcast.

Who has <IP> tell <IP>

If there is no reply to the request there is problem on firewall with config

Re: arp is not learning on SMB devcie

Surendra — Mon, 16 Sep 2024 08:47:47 GMT

Not getting output for above tcpdump commands.

Re: arp is not learning on SMB devcie

PhoneBoy — Mon, 16 Sep 2024 15:14:38 GMT

This points to a physical connectivity issue.
Again, a diagram showing the physical connectivity between fw01, fw02, and the relevant host would help tremendously.