Greetings, I have a router, which can be simplified as this: SRV <-> (111.111.111.0/24) <-> R1 <-> (provider /30 net with BGP) R1 is 2901 and also running ZBFW. All the setup is working.   If I listen to my network on SRV i see lot of ARP queries from R1 to all the non-existent hosts in this network. I think this is caused by internet traffic when someone try to ping (or connect) to random IP's. I also see these tries on ZBFW log.    I am quite unpleasant of hundreds of junk ARP queries and wish to solve that, but first I have a question: I see ZBFW filtering all connections to my network, but why R1 continue generating ARP-queries?   Anyway I have no success disabling arp traffic to non-existent hosts. I was trying:   1. Disable ARP. I wanted to use static ARP records for existing hosts, but found no way to disable ARP on interface. 2. Route to Null. I tried to create static route to null0 and static host routes to existing hosts - I found no way to disable connected interface route (which was created automatically).   Here I have no ideas why this happens and how to disable it. If you have any idea - thanks in advance. Config parts follows:   ip arp proxy disable ! class-map type inspect match-any pub-ann-cmap   match access-group name admin-acl   match access-group name pub-ann-acl ! policy-map type inspect pub-ann-pmap   class type inspect pub-ann-cmap     inspect   class class-default     drop log ! zone security public zone security private zone security announced ! zone-pair security pub-ann source public destination announced service-policy type inspect pub-ann-pmap ! interface GigabitEthernet0/1.1190   encapsulation dot1Q 1190   ip address 111.111.111.15 255.255.255.0   zone-member security announced   ip ospf authentication message-digest   ip ospf message-digest-key 1 md5 7 X ! interface GigabitEthernet0/1.2121   encapsulation dot1Q 2121   ip address 9.4.4.8 255.255.255.252   no ip redirects   no ip unreachables   zone-member security public   ip ospf shutdown ip access-list standard admin-acl   permit 4.2.2.1   permit 4.2.2.5   permit 5.9.6.4   permit 5.9.6.3   permit 5.9.1.2 ! ip access-list extended pub-ann-acl   permit tcp any host 111.111.111.12 eq www   permit udp any host 111.111.111.12 eq domain   permit tcp any host 111.111.111.12 eq domain   permit tcp any host 111.111.111.12 eq 443   ... View more