Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Advisor

How to send G-ARP manually?

Jump to solution

Dear team

      I encounter a problem. I replace a juniper firewall with checkpoint application,all dnat is not accessible when i online checkpoint application.I believe this is a arp cache problem,because the dnat is accessible when i modify checkpoint wan interface mac and replace it with juniper wan interface mac.

    I think if i can send a g-arp manually,all problem will be solved.So,how to i can send a g-arp  manually,thanks!

0 Kudos
1 Solution

Accepted Solutions
Highlighted
Champion
Champion

THE ISSUE

A new firewall has been procured and you've configured it with all the same IP addresses/routing and security policy as the old firewall. When cut into production, traffic doesn't seem to be flowing between the new firewall and a directly-attached Layer 3 switch/router. Running a:

Code:
Expert# tcpdump -eni ethX

Shows outbound traffic leaving your firewall to the router and replies coming back, but the destination MAC address on the reply frames is still showing the MAC address of the old firewall.

THE SOLUTION

Obviously the optimal solution is to clear the ARP cache on the router, but what if administrative access to it cannot be obtained? Physical access will of course allow a quick power-cycle of the router to clear the cache; one can also try unplugging the physical router interface which may flush any ARP cache entries associated with that interface. With a cluster of firewalls, initiating a failover will cause the new active member to send a gratuitous ARP for the firewall's cluster address and all NAT addresses for which proxy ARP is being performed to solve the problem (this assumes of course that "Use cluster MAC" is not set on the cluster object).

However if there is just a single firewall and not a cluster is there a way to force the firewall to send a gratuitous ARP not only for itself but all NAT addresses that it is supposed to perform proxy ARP for?

THE ARPING COMMAND

Built into SecurePlatform and Gaia is a little-known tool called arping. This command allows the creation of ARP traffic including gratuitous ARPs. For example if the external IP address of your firewall is 129.82.102.32/24 on interface eth1, the following command will cause the firewall to send 4 gratuitous ARPs for its own address, thus updating the ARP cache of any directly adjacent routers on that interface:

Code:
Expert# arping -c 4 -A -I eth1 129.82.102.32
ARPING 129.82.102.32 from 129.82.102.32 eth1
Sent 4 probes (4 broadcast(s))
Received 0 response(s)

This works great for the firewall's address, but what about all those other IP addresses we have plucked from 129.82.102.0/24 for purposes of NAT like 129.82.102.222?

Code:
Expert# arping -c 4 -A -I eth1 129.82.102.222
bind: cannot assign requested address

Oops. Well as it turns out this can be made to work even for addresses that are not physically assigned to interface eth1:

Code:
Expert# echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind
Expert# arping -c 4 -A -I eth1 129.82.102.222
ARPING 129.82.102.222 from 129.82.102.222 eth1
Sent 4 probes (4 broadcast(s))
Received 0 response(s)

Taking this a step further, the command fw ctl arp shows a list of addresses plucked from our ISP-assigned range for which the firewall believes it needs to perform proxy ARP so NAT will work for those addresses. For arping to send gratuitous ARPs for every IP address in this list the following command sequence will strip out the IP addresses and feed them one by one to the arping command:

Code:
Expert# fw ctl arp | cut -d\( -f2 | cut -d\) -f1 | xargs -i -t arping -c 4 -A -I eth1 {}

This command will update the ARP cache of a directly-attached Layer 3 switch/router without having to access it or wait the usual default ARP timeout of 4 hours. Obviously this will not work with a router that has been configured to ignore gratuitous ARPs

R80.40 addendum for book "Max Power 2020" now available
for free download at http://www.maxpowerfirewalls.com

View solution in original post

6 Replies
Highlighted
Champion
Champion
Gratuitous ARP to force a new MAC addess towards the router

When you want to send the G-ARP for an address that is not configured on a interface you need to enable binding to non-local IP addresses on-the-fly:
echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind <---- 0=off, 1=on
arping -c 4 -A -I eth3 10.10.10.10
Replace interface and IP with the ones you need.
Regards, Maarten
0 Kudos
Highlighted
Champion
Champion

THE ISSUE

A new firewall has been procured and you've configured it with all the same IP addresses/routing and security policy as the old firewall. When cut into production, traffic doesn't seem to be flowing between the new firewall and a directly-attached Layer 3 switch/router. Running a:

Code:
Expert# tcpdump -eni ethX

Shows outbound traffic leaving your firewall to the router and replies coming back, but the destination MAC address on the reply frames is still showing the MAC address of the old firewall.

THE SOLUTION

Obviously the optimal solution is to clear the ARP cache on the router, but what if administrative access to it cannot be obtained? Physical access will of course allow a quick power-cycle of the router to clear the cache; one can also try unplugging the physical router interface which may flush any ARP cache entries associated with that interface. With a cluster of firewalls, initiating a failover will cause the new active member to send a gratuitous ARP for the firewall's cluster address and all NAT addresses for which proxy ARP is being performed to solve the problem (this assumes of course that "Use cluster MAC" is not set on the cluster object).

However if there is just a single firewall and not a cluster is there a way to force the firewall to send a gratuitous ARP not only for itself but all NAT addresses that it is supposed to perform proxy ARP for?

THE ARPING COMMAND

Built into SecurePlatform and Gaia is a little-known tool called arping. This command allows the creation of ARP traffic including gratuitous ARPs. For example if the external IP address of your firewall is 129.82.102.32/24 on interface eth1, the following command will cause the firewall to send 4 gratuitous ARPs for its own address, thus updating the ARP cache of any directly adjacent routers on that interface:

Code:
Expert# arping -c 4 -A -I eth1 129.82.102.32
ARPING 129.82.102.32 from 129.82.102.32 eth1
Sent 4 probes (4 broadcast(s))
Received 0 response(s)

This works great for the firewall's address, but what about all those other IP addresses we have plucked from 129.82.102.0/24 for purposes of NAT like 129.82.102.222?

Code:
Expert# arping -c 4 -A -I eth1 129.82.102.222
bind: cannot assign requested address

Oops. Well as it turns out this can be made to work even for addresses that are not physically assigned to interface eth1:

Code:
Expert# echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind
Expert# arping -c 4 -A -I eth1 129.82.102.222
ARPING 129.82.102.222 from 129.82.102.222 eth1
Sent 4 probes (4 broadcast(s))
Received 0 response(s)

Taking this a step further, the command fw ctl arp shows a list of addresses plucked from our ISP-assigned range for which the firewall believes it needs to perform proxy ARP so NAT will work for those addresses. For arping to send gratuitous ARPs for every IP address in this list the following command sequence will strip out the IP addresses and feed them one by one to the arping command:

Code:
Expert# fw ctl arp | cut -d\( -f2 | cut -d\) -f1 | xargs -i -t arping -c 4 -A -I eth1 {}

This command will update the ARP cache of a directly-attached Layer 3 switch/router without having to access it or wait the usual default ARP timeout of 4 hours. Obviously this will not work with a router that has been configured to ignore gratuitous ARPs

R80.40 addendum for book "Max Power 2020" now available
for free download at http://www.maxpowerfirewalls.com

View solution in original post

Highlighted
Explorer

Funny i came across this topic as i'm using arping at the moment, 

The issue is it dosent appear to be installed . 

 

[Expert@sIFirewall]# arping
bash: arping: command not found

 

 

Product version Check Point Gaia R77.20
OS build 124
OS kernel version 2.6.18-92cp
OS edition 32-bit

0 Kudos
Highlighted
Champion
Champion

It is definitely there as /usr/sbin/arping on R80.30 kernel 3.10 and R80.10 kernel 2.6.18.  I know it was in SecurePlatform too.

R80.40 addendum for book "Max Power 2020" now available
for free download at http://www.maxpowerfirewalls.com
0 Kudos
Highlighted
Advisor
Thanks
0 Kudos
Highlighted

What if I need to send G-ARP using Cluster VMAC and not PHI node MAC. Using the "standard" "arping -c 4 -A -I  <int> <ip address>" sends and arp reply with PHI MAC ( i.e. arp reply <ip address> is-at <PHI MAC). Is there any way to force the VMAC?

That would be the proper way to do it when you have a cluster with VMAC... Otherwise the peer router learns the PHI mac of the active node... and only when the peer router issues another ARP request will it update its ARP table with the right VMAC...

On many Linux distributions arping gives you the possibility to specify the MAC  address on the arp reply. On Gaia this doesn't seem possible.

 

Thank you for a feedback

Tags (3)
0 Kudos