Core issue
Incorrect Address Resolution Protocol (ARP) entry for PIX on gateway router.
Resolution
Most commonly, this is caused by an incorrect ARP entry in the outside gateway router.
Remember that routers route to physical MAC addresses, not IP addresses, and they usually cache these layer 2 addresses for several hours. If the PIX is replacing another firewall or device with the same IP address as the outside interface of the PIX, the ARP entry on the gateway router needs to be refreshed before it can forward packets to the PIX.
To clear the ARP tables on Cisco routers, issue the clear arp-cache command, or reboot the router.
