Description

This article describes the issue of the NAT rules, for which proxy ARP is configured, not working, after a device is replaced with a SRX or J-series device that has an equivalent configuration.

Symptoms

The NAT rules, for which proxy ARP is configured, has stopped working.

Solution

This issue is due to the upstream router still containing the ARP entry of the last device's interface in it's ARP table. When a SRX or J-series device is put in place of the previous device, proxy ARP IP addresses will only reply to ARP-requests that come in from the upstream device; but as the upstream device already has an ARP entry, it does not send a new ARP-request, which results in the incorrect ARP entry.

To resolve this issue, you can clear the ARP entries on the upstream device or configure the proxy ARP IP addresses on the SRX/J-series device's interface that is connected to the upstream device; so that it forces the device to send a G-ARP, which updates the ARP table of the upstream device.

Assume that the device configuration is as follows: 

root@100-1# show interfaces fe-0/0/0 
unit 0 {
    family inet {
        address 1.1.1.1/24;
    }
}

[edit]
root@100-1# show security nat proxy-arp 
interface fe-0/0/0.0 {
    address {
        1.1.1.2/32;
        1.1.1.3/32;
    }
}
The NAT rules, for which proxy-ARP is configured, have stopped working. To resolve this, you will have to configure the IP addresses on the interface, which forces a G-ARP and de-activates the proxy-ARP (as it will not allow us to commit).

Also, before that, you have to make the already configured IP address as the primary and preferred, just to make sure that no connectivity issues arise with the other host-inbound-traffic (such as VPN, BGP, OSPF). So, the new configuration will be as follows: 
xroot@100-1# show interfaces fe-0/0/0.0 
family inet {
    address 1.1.1.1/24 {
        primary;
        preferred;
    }
    address 1.1.1.2/24;
    address 1.1.1.3/24;
}

[edit]
root@100-1# show security nat proxy-arp     
inactive: interface fe-0/0/0.0 {
    address {
        1.1.1.2/32;
        1.1.1.3/32;
    }
}
Perform a commit and now the NAT rules should start working. You can now rollback to the previous configuration (by performing rollback 1 and then a commit).