topic Re: PIX ARP problem in Network Security

PIX ARP problem

mrcomm2000 — Fri, 21 Feb 2020 06:55:48 GMT

Dear All

I got a problem with my PIX 525, when i upgraded the IOS from 6.1 to 6.3 .

The problem is that the Gateway router failed to catch the mac-address (of the PIX) of some machines behind the firewall although the firewall see these machines, i don't know if it is problem of proxy arp in the PIX or what ???

The problem took place with one range of IPs x.x.x.x although there is no problem with the same machines if they are natted with another range y.y.y.y...

I made a workaround by putting a static arp for those machines on the Gateway and they are now seen by the gateway ...

I don't know what is exactly the problem ...

I hope anyone can help ...

Re: PIX ARP problem

jmia — Tue, 12 Aug 2003 12:15:07 GMT

Hi -

Have you got command - sysopt noproxyarp inside ?

Thanks -

Re: PIX ARP problem

mrcomm2000 — Tue, 12 Aug 2003 12:29:31 GMT

No i don't, but i found i bug related to this IOS 6.3(1)

Here is the Bug ID CSCeb06082

Re: PIX ARP problem

l.mourits — Thu, 14 Aug 2003 09:29:40 GMT

Hi,

The PIX does proxy-ARP by default for every static translated address or range of addresses. For example, the command:

static (inside, outside) 62.219.219.189 10.1.1.1

will let the PIX proxy-ARP for the address 62.219.219.189 on the outside interface

The command no sysopt proxyarp is not needed if static translations are setup correctly.

You could post you config (remove passwords and real IP's) and we can have a closer look at it.

Kind regards,

Leo

Re: PIX ARP problem

mrcomm2000 — Thu, 14 Aug 2003 13:15:10 GMT

Dear Leo

First thank you for your help, but i opened a case with the TAC, and i found that the IOS version 6.3.1 has a bug that made what i told you, The BUG ID CSCeb06082 you can take a look at it....

I know you are talking from the technical point of view of facts but what the IOS does is sometimes different ...

Thanks again