ARP entry may not get updated in the firewall when the route for the IP address is pointing to a different interface rather than one in which the ARP entry is learned.

 When the firewall gets the ARP response packet on a given interface, but the route in the route table points a to a different interface, the ARP reply packet will be dropped.

To troubleshoot this problem we need to get the output of "debug arp all"

"debug arp all"  will show  ARP queries sent after the  ARP timeout. The ARP reply received on firewall  interface may be dropped. This is because of the following condition.

The firewall before updating it's ARP cache does a route lookup in it's virtual router. The route should point to the same interface in which the ARP reply is received.

If in the routing table  there is a static or dynamically learnt route is there pointing to a different interface apart from the one in which the ARP replies are received, the firewall will drop the ARP replies and start ARP retries.

To resolve this issue ensure proper routing is in place for the ARP replies to be handled correctly.

2025-06-26: Minor, non-technical update

2006-09-24: Article created