ARP Spoofing

[ahmed ferhan]

Hi everyone, have a nice day

I have a big network with multiple cisco routers, switches(IOSXE, IOSXR), and NX, I found in the ARP table multiple IP addresses with the same mac address, I try to track the mac address but the port for this mac return me the previous router 

please any help or explain this issue

[MHM Cisco World]

are there any static route toward this router 

[ahmed ferhan]

of course, there is ..

[MHM Cisco World]

so config the static route as following 
ip route x.x.x.x y.y.y.y <egress interface> <next-hop>
this will stop ARP issue. 
for more info. check link below
https://www.cisco.com/c/en/us/support/docs/dial-access/floating-static-route/118263-technote-nexthop-00.html

[ahmed ferhan]

i config this route as ( ip route 0.0.0.0 0.0.0.0 + (ip which is the gateway))

[MHM Cisco World]

that great you already specify the the next-hop so no issue at all but for many arp let me make deep dive, 
I will update you soon 

[ahmed ferhan]

I'll be appreciated you

[Aref Alsouqi]

That could be due to a static route that is pointing to the exit interface rather than to the next hop which is not really recommended at all.

[ahmed ferhan]

the default route already exist into the switch because i need the end user to reach the internet

[MHM Cisco World]

hi friend 
I dont forget you but I was looking for case that ARP is use for each IP in subnet 
1- static route toward interface (this we discus before you confirm that you use next-hop not interface)
2- PBR with set interface 

so for second case can you confirm that you use PBR?

[ahmed ferhan]

Hi MHM, thank you for your support, I am so appreciated your followed
into( Router and SW)  I am setting two access list controls only without route-map 
the first access list is used for management access and this set on ssh protocol  and the second access list is used for port security ( traffic or services )that allowed to pass through the router and this set to the management interface