Show Arp Command Not Showing Everything It should be

[chueymtz]

I'm trying to figure out why my show arp isn't showing all my of addresses for Vlan 2. Vlan 1 shows the correct addresses which would be 74.x.x.233-238. Vlan 2 should show 70.x.x.65 - 70 

3560-CX_HQ_ASA_GATEWAY#show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 65.x.x.85 17 54e0.xxxx.xxxx ARPA GigabitEthernet0/1
Internet 65.x.x.86 - 3c41.xxxx.xxxx ARPA GigabitEthernet0/1
Internet 70.x.x.67 - 3c41.xxxx.xxxx ARPA Vlan2
Internet 73.x.x.76 - 3c41.xxxx.xxxx ARPA GigabitEthernet0/2
Internet 74.x.x.233 - 3c41.xxxx.xxxx ARPA Vlan1
Internet 74.x.x.234 0 001c.xxxx.xxxx ARPA Vlan1
Internet 74.x.x.235 109 001c.xxxx.xxxx ARPA Vlan1
Internet 74.x.x.236 0 Incomplete ARPA
Internet 74.x.x.237 0 001c.7f84.xxxx ARPA Vlan1
Internet 74.x.x.238 0 001c.7f84.xxxx ARPA Vlan1

[Georg Pauwen]

Hello,

I think the default ARP timeout is 4 hours. What is the mac address table aging time ?

--> show mac address-table aging-time

[chueymtz]

3560-CX_HQ_ASA_GATEWAY#show mac address-table aging-time
Global Aging Time: 300
Vlan Aging Time
---- ----------

[MHM Cisco World]

depend on config, 
can you share the config

[chueymtz]

!
interface GigabitEthernet0/1
description connection to Internet
no switchport
ip address 65.x.x.86 255.255.255.252
!
interface GigabitEthernet0/2
description to Comcast Router
no switchport
ip address 73.x.x.76 255.255.255.248
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface GigabitEthernet0/5
switchport mode access
!
interface GigabitEthernet0/6
switchport mode access
!
interface GigabitEthernet0/7
switchport access vlan 2
switchport mode access
!
interface GigabitEthernet0/8
switchport access vlan 2
switchport mode access
!
interface GigabitEthernet0/9
!
interface GigabitEthernet0/10
!
interface GigabitEthernet0/11
!
interface GigabitEthernet0/12
!
interface Vlan1
ip address 74.x.x.233 255.255.255.248
!
interface Vlan2
ip address 70.x.x.67 255.255.255.248
!
ip forward-protocol nd
!
!
ip http server
ip http secure-server
ip route 0.0.0.0 0.0.0.0 65.x.x.85
ip route 0.0.0.0 0.0.0.0 70.x.x.70
!
!
access-list 46 permit 185.189.149.184
access-list 46 permit 185.189.151.235
access-list 46 permit 89.248.173.131
access-list 46 permit 185.158.251.126
access-list 46 permit 185.212.47.166
access-list 100 permit ip 0.0.0.1 255.255.255.248 any
access-list 110 permit ip 0.0.0.3 255.255.255.248 any
!
!
route-map ISP-B permit 10
match ip address 110
set ip next-hop 73.x.x.76
!
route-map ISP-A permit 10
match ip address 100
set ip next-hop 65.x.x.86
!
!
!
line con 0
line vty 0 4
access-class 46 in
privilege level 15
login local
transport input telnet ssh
line vty 5 14
access-class 46 in
login
line vty 15
login
!
!
end

[MHM Cisco World]

this config is not complete
anyway it give me hint, 
are you use dhcp exclude from 233-238 ?

[chueymtz]

no I am not using dhcp exclude. What is missing from the config?

[Richard Burts]

It is difficult to know all the things that are missing, but for example you show access list 46 but do not show how it is applied. And you show 2 route maps but not how they are used. 

The partial config that you post shows 2 interfaces assigned to vlan 2. Can you confirm that there are devices connected to these interfaces and active? And if so can you post the output of ipconfig (or other appropriate command depending on OS) to demonstrate whether they have IP addresses in the subnet  70.x.x.67 255.255.255.248

[chueymtz]

Yea this was setup by someone else and I'm new to cisco so I'm trying to figure this out, I currently have the 2 ports on vlan 2 disconnected but I will try on Tuesday when i get back to work. The setup has century link 65.x going into port 1 and vlans to the 74.x address where ports 3 and 4 are assigned to vlan 1, port 2 goes to comcast router 73.x and vlans to port 7 and 8 and from there they go out to our checkpoint firewall interfaces for redundancy but that isn't working. 

[MHM Cisco World]

first there is route-map and we dont where it apply 
second there are many access-list is for NAT or for other ACL policy. 

[chueymtz]

Yes, I didn't set these up, I'm not sure why they are there either but I don't know how to configure .

[Richard Burts]

The original post asked about "missing" entries in the arp table. There may well be other aspects of this situation which need further discussion. But we now have the answer to the original question: there are no other entries in the arp table for vlan 2 because there are no devices connected to ports in vlan 2. Therefore there are no active IP addresses in that subnet (other than the switch interface). And so there are no arp entries for that subnet/vlan. When there are active devices in that vlan then there should be arp entries.

[chueymtz]

Thanks, i disconnected before the weekend so I didn't leave anything down, this is not working when i have the equipment connected either.

[Georg Pauwen]

Hello,

maybe 'debug arp' reveals what is going on, can you enable that and post the output ?

[chueymtz]

I ran debug arp but can't seem to get it to quit running, what is the command to stop it? I tried no debug arp but nothing seems to stop the debug log