ASA 5525 and ARP Collisions for Broadcom BCM5709S Teamed NICs

[francesco.chiarelli11]

I am running an ASA 5525 which complains a lot about ARP collisions from all servers with teamed NICs. The ASA version is Firmware 9.1(7).

----------------------------

405001 Received ARP request collision from 10.138.XX.XX/0010.18fb.XXXX on interface DRDMZ-External-Env-VLAN_2 with existing ARP entry 10.138..XX.XX/5cf3.fc24.XXXX

733100 [ Scanning] drop rate-1 exceeded. Current burst rate is 28 per second, max configured rate is 10; Current average rate is 49 per second, max configured rate is 5; Cumulative total count is 29851

----------------------------

After some Googling this problem is pointing to be related to NIC Teaming configuration using Load balancing mode. We are using IBM Blade HS23 and HX5 with 2 Broadcom BCM5709S NetXtreme II GigE NICs.

My question are:

1)Is the ASA dropping all the traffic to the NIC that advertises itself with the ARP message that generates these warnings ?

2)Is the Smart Load Balancing configuration is actually useless since all the traffic used by one of the NIC is blocked by the ASA?

Cheers,

Francesco

[francesco.chiarelli11]

Additionally I am not sure it the event 405001 is related to the 733100 [ Scanning] drop rate-1 exceeded warning.

[Aditya Ganjoo · Accepted solution]

Hi,

Since you are using a NIC TEAM for the same ip address, because firewall has received an ARP

packet, and the MAC address in the packet differs from the ARP cache entry it would drop the ARP packet and generate this message.

I would suggest you to use a Virtual MAC on the NIC so that ASA is able to process the Arp entries.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[francesco.chiarelli11]

Hi Aditya,

The  "SMART Load Balancing and Failover" teaming is using a dedicated MAC address per each teaming members. We need to connect the server to different switches for redundancy. It is not possible to set up a virtual MAC.

The broadcom driver is selecting a MAC address of one NIC or the other during the load balancing.

By the way, is the ASA dropping only the ARP or also other packect that contains  IP/MAC that is not in the ASA ARP cache?

Thanks for answering to my first questions.

Francesco

[Aditya Ganjoo]

Hi,

ASA is only dropping the ARP packets and that's why you see these logs.

You can even confirm by using ARP captures on the ASA's interface:

capture arp ethernet-type arp interface <> 

Regards,

Aditya

Please rate helpful posts and mark correct answers.