Proxy arp issue - automatic NAT rule

[carl_t]

Hi All

We had an issues yesterday whereby we created a static NAT on the object but it didnt work.

We found that we needed to manually put the proxy arp entry on the gateway.

We have the global properties set to automatic arp configuration and merge manual proxy arp configuration set.

I thought that when doing automatic rules such as on the object you dont need to add it manually on the gateway? why would this not have worked ?

Cheers

[Don_Paterson]

Automatic static NAT rules should add a proxy arp entry into the kernel running config. 

The command to check it on the gateway/s after the policy installation is:

fw ctl arp

Was it a Host object and a standard configuration? Meaning nothing complicated, just a normal host static NAT.

[carl_t]

Hi, yes it was a host object with the static NAT config applied, it only seemed to work if we added the manual proxy arp entry on Gaia.

If i removed the manual proxy arp entry and typed fw ctl arp, it was actually showing in there

[Chris_Atkinson]

Did you install policy after making the change?

Was the mac-address the expected one for the given cluster member?

[carl_t]

Hi Chris, yes and yes

[the_rock]

Hey Carl,

I would agree with Don on this one. If you checked everything, TAC case sounds like the best idea at this point.

[Don_Paterson · Accepted solution]

The automatic static NAT rule adds the proxy arp during policy install and as long as there are no typos then the expected behaviour is that the gateway/cluster 'takes responsibility' for the static NAT IP address. Meaning that it replies to the ARP WHO HAS with the interface in the relevant subnet.

If you double checked everything, which I am sure you did, and maybe some packet captures to see the behaviours on the network (looking for ARP WHO HAS and ARP IS AT), then it may be a problem with the software (bug).

The fact that it worked with a Gaia level proxy arp seems to point to a software of config error.

Sounds like one for TAC if you have done all the checks.

[Lesley]

share screenshot to make sure no mistakes are made from the host object