Description

Configured NAT with proxy ARP.


But traffic never arrives on SRX.

Symptoms

If on Branch or SRX1500, when configuring tcpdump on PFE with the following petameters show ARP Requests arriving yet no response from SRX:



FLOWD_OCTEON(srx5072 vty)# tcpdump 100

jpf_atom_cnt : 100(0x64)

jpf_enable : TRUE

jpf.dump_total 0x000: 100

jpf.eth_any 0x040: aa:bb:cc:dd:ee:rr <--- Any direction, hence we should notice ARP responses

jpf.eth_type 0x074: 0x806


FLOWD_OCTEON(srx5072 vty)# tcpdump


tcpdump is running. 9/100 packets captured:


1 22:09:18.749120 RX len 60, ge-0/0/0 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806) Request who-has 192.168.0.229 tell 192.168.0.225


2 22:09:19.349077 RX len 60, ge-0/0/0 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806) Request who-has 192.168.0.229 tell 192.168.0.225


3 22:09:20.049039 RX len 60, ge-0/0/0 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806) Request who-has 192.168.0.229 tell 192.168.0.225


4 22:09:20.648267 RX len 60, ge-0/0/0 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806) Request who-has 192.168.0.229 tell 192.168.0.225


5 22:09:23.999435 RX len 60, ge-0/0/0 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806) Request who-has 192.168.0.229 tell 192.168.0.225


6 22:09:24.648638 RX len 60, ge-0/0/0 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806) Request who-has 192.168.0.229 tell 192.168.0.225


7 22:09:25.448791 RX len 60, ge-0/0/0 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806) Request who-has 192.168.0.229 tell 192.168.0.225


8 22:09:26.248959 RX len 60, ge-0/0/0 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806) Request who-has 192.168.0.229 tell 192.168.0.225


9 22:09:26.948856 RX len 60, ge-0/0/0 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806) Request who-has 192.168.0.229 tell 192.168.0.225


Solution

Deleting the "set firewall drop-non-device-arp" will fix the issue.

Modification History

2026-05-25 : Article Created