PIX 515 responding to ARP commands...

I have a strange thing on my network...

Setup is 5x 3com SuperStack Switches, 3x HP DL 380's, 1x NetApp Filer routed through to 1x PIX 515e.

So my problem is that occasionally I lose a device off the network. It won't completely drop from the network, but my machine will lose any kind of connection to it. The same might happen from a different machine, but not at the same time. Random machines will lose connection to another random machine at random intervals!!!

The confusing thing is that when the machine 'disappears', the PIX replies to the ARP request!!!

I have Packetyzer monitoring the network traffic, and I see an ARP request going out from my machine, and then the PIX replying to this ARP request. But this only happens randomly, and as I say, with random machines.

I've removed Broadcast Storm control from the 3com's, no VLAN's are in place, and no special routing is setup on the PIX. I can setup static ARP records on the PIX, but this isn't an ideal solution, and is it going to stop the PIX replying with it's own MAC address?

Reply to
Chris Kranz
Loading thread data ...

In article , Chris Kranz wrote: :I have a strange thing on my network...

:Setup is 5x 3com SuperStack Switches, 3x HP DL 380's, 1x NetApp Filer :routed through to 1x PIX 515e.

:So my problem is that occasionally I lose a device off the network. It :won't completely drop from the network, but my machine will lose any :kind of connection to it.

:The confusing thing is that when the machine 'disappears', the PIX :replies to the ARP request!!!

I knew I recognized this... this is the "Losing connection" thread from comp.dcom.lans.ethernet .

formatting link
I see you took my advice there and snooped and saw the ARPs that I hypothesized then.

You didn't happen to mention then, and didn't mention now, which PIX software version you are running.

When you see the ARP reply coming from the PIX, does it have the PIX's MAC -and- IP ?

The 3Com Superstacks: as I recall those are usually layer 2 switches, but there was [I seem to recall] layer 3 extensions available for them. You have 5 of them for a network that you imply contains only 3 hosts, so are they running routing, or are they connected in an unusual topology, or are they running a redundancy protocol or the like?

Are you running any kind of routing protocol in-house? Is your PIX emitting a default route towards the inside, which is normally overridden by something with a better route but that something drops the ball?

The machines that you lose connection with, are they are the same subnet as "your machine" ?

Is this happening -only- to "your" machine, or to several machines in your network? What OS is "your" machine running? (Is it one of the Proliants?)

Reply to
Walter Roberson

Try: sysopt noproxyarp inside

Regards, Christoph Gartmann

Reply to
Christoph Gartmann

formatting link

apologise for splitting the thread, as i tracked it closer to the pix, i thought it'd be more appropriate here.

yeah, had some issues with ethereal at first, but packetyzer is doing a good job.

PIX Firewall Version 6.3(4) - Compiled on Fri 02-Jul-04 00:07 by morlee

according to packetyzer...


Packetyzer Trace:

Frame 1 (60 bytes on wire, 60 bytes captured) Frame is marked: False Arrival Time: Aug 31, 2005 13:02:12.689705000 Time delta from previous packet: -15837.314363000 seconds Time since reference or first frame: 591.799104000 seconds Frame Number: 1 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:arp Ethernet II, Src: 00:13:c3:65:dc:c9, Dst: 08:00:46:da:c7:52 Destination: 08:00:46:da:c7:52 (Sony_da:c7:52) Source: 00:13:c3:65:dc:c9 (indi.b2net.lan) Source or Destination Address: 08:00:46:da:c7:52 (Sony_da:c7:52) Source or Destination Address: 00:13:c3:65:dc:c9 (indi.b2net.lan) Type: ARP (0x0806) Trailer: 000000000000000000000000000000000000 Address Resolution Protocol (reply) Hardware type: Ethernet (0x0001) Protocol type: IP (0x0800) Hardware size: 6 Protocol size: 4 Opcode: reply (0x0002) Sender MAC address: 00:13:c3:65:dc:c9 (indi.b2net.lan) Sender IP address: ( Target MAC address: 08:00:46:da:c7:52 (Sony_da:c7:52) Target IP address: (

0000: 08 00 46 DA C7 52 00 13 C3 65 DC C9 08 06 00 01 ..F..R...e...... 0010: 08 00 06 04 00 02 00 13 C3 65 DC C9 0A 00 00 91 .........e...... 0020: 08 00 46 DA C7 52 0A 00 00 3C 00 00 00 00 00 00 ..F..R...

I had an unmanaged gigabit switch, which i've since ripped out and replaced with a superstack 3 10/100 which gives me a little more control of the traffic. i've ripped out as much of the management as i can, lowered the arp cache to 60 seconds, removed broadcast storm control and the multicast filtering. no link aggregation.

there's 4x superstack 4200's which have both gigabit ports going into a superstack 4400. originally there was an unmanaged 3com gigabit switch which these plugged into. there's no real need for 2 uplinks, other than a little redundancy and speed. i appreciate that without link aggregation or any management across these 2 ports this is pretty redundant though, and probably pointless!!!

only thing i've done, which is from today, is added static arp records onto the pix for the 4 main servers / filer, although not for my own machine.

I have 3 main servers another 3 servers, 1 file server, vpn 3000 and pix and about 50 users. all on the same subnet, all using the same default route which is the PIX. No internal routing setup, no routing protocols, dhcp on one of the servers dishes out the default route and IP's.

All clients are using Windows XP (including myself and on SP2), majority of servers are running Windows 2003. I'm hesitant to put it down to an OS problem as I've ironed out much of the problems i had with the proliant to begin with, and the same problem is occuring on the NetApp filer.

I lose the connection randomly on random machines which are plugged into any number of the 5 switches.

I've fairly new to getting into this much detail when it comes to networking, so i'm learning a lot, very quickly! so apologise for my ignorance. hope this is enough to give you more of a clue?

many thanks for your help...

Reply to
Chris Kranz

I'm guessing the first option here has solved my problems, things seem to be running perfectly now, I've re-plugged in the unmanaged gigabit switch, and everything seems to be great!!!

What is the proxyarp on the PIX for? And why was it causing these problems? Not sure whether the pix has stopped responding to ARP requests, or if it still is, whether it's giving a correct record now that I've added in static records. Will go through my packet logs, but I'm guessing the PIX has stopped responding.

Many thanks for all your help...

Reply to
Chris Kranz

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.