How to list arp table and identify network devices with mac under Check Point FWs

[Taner]

Hello Check Point community,

I am faced with a specific issue.
Few networks and subnets are directly migrated to Check Point FWs.
The layer 3 interfaces are directly defined on the Check Point FWs.
And now for all hosts under these networks under CP, I can't see arp table and mac table, and I am not able to identify the devices under these networks.

In a scenario where the Layer 3 IP of the networks are defined under core switch, everything is clear and I can identify everything.

I think about NeDi – Find IT.
Do you have experience with NeDi – Find IT and Check Point FWs?
If we connect Nedi to Checkpoint with SNMP can Nedi find information about hosts and machines under subnets with L3 Gw defined under CP?

Thank you in advance.
Best Regards.

[PhoneBoy · Accepted solution]

I'm pretty sure the arp table is not something we make available via SNMP.
That said, you can always make a custom OID that provides this information: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
Whether it can be processed by NeDi is a separate question.

[michaelhd]

Hi, I have the same problem, and I can't find the section in the linked kb to do this. Is there a more specific instruction?

thank you.

[Chris_Atkinson]

(IV-6) Advanced SNMP configuration - Extend SNMP with shell script

Further hints:

show arp dynamic all

-or-

arp -a

[Lubomir_Cerny]

I have found that there is OID .1.3.6.1.2.1.4.35.1.4 on R81.20 which returns arp table from FW. Result from snmpwalk looks like:

IP-MIB::ipNetToPhysicalPhysAddress.29.ipv4."10.x.x.x" = STRING: cc:15:31:17:b1:e6
IP-MIB::ipNetToPhysicalPhysAddress.31.ipv4."10.x.x.x" = STRING: 0:50:aa:4f:26:59

Works also on SMB Spark boxes with R81.10.x

Maybe it will help someone 🙂