Hi all:
I am having an issue with a 1:1 NAT on an FTD. I have two FTDs (both managed by an FMC), and they both have 1:1 NATs. The NATs are working on one FTD, but not on the other. They have different flavors of internet, and the problem is related to the connection.
Referring to the FTD with NATs that are not working, there are several static IPs on that internet service. I verified with the ISP that they are configured on the circuit, and one of the other IPs was on the FTD's WAN interface before I changed it to what the IP is now. The IPs are in the same subnet. I talked to the ISP about this fiber connection, and was told that the session for each static IP isn't static, it's dynamically built. What triggers the building of the session is when the gateway (the ISP) receives an ARP from the static IP. That sets off a series of events that builds the session for that particular static IP.
The IP on the FTDs WAN interface is working because the FTDs ARP for the gateway's MAC would have had its interface IP. I see in a packet capture that it's sending out packets which are sourced from the second static IP, but there's no return traffic. No session was built for the second static IP because the FTD won't send an ARP containing the second static IP. That makes sense to me because the FTD already knows the MAC of the gateway. It doesn't see a reason to ARP for it again.
I realize that this is likely not possible, but I'll ask anyway. Is it possible to have the FTD periodically send an ARP with an IP other than the interface IP? I see no way to do this in the FMC. I consoled in to the FTD and saw that 'arping' is in Expert mode, but I can't source ARPs from the WAN interface. It's not listed in an 'ip addr'. I assume that's because the FTD part of the box has control of that. Is there another way to address this problem?
