A lot of ARP requests from the same broadcast domain coming to SRX, makes RE cpu busy
A lot of ARP requests from the same broadcast domain coming to SRX, makes RE cpu busy.
It results in packet drop on SRX sometimes.
A new ARP filter feature which should address this issue will be introduced in 23.4R2-S3.
This feature attempts to mitigate the issue by dropping ARP probe packets in PFE which are not for resolving MAC addresses of the IP addresses belonging to SRX. This feature is being controlled by a CLI knob "set firewall drop-non-device-arp", which will be disabled by default.
How to check the counters from the system
request pfe execute command "show filter counters" target fwdd >> For Branch Box
request pfe execute command "show filter counters" target fpc0 >> For HE box
user@srx-lab>request pfe execute command "show filter counters" target fwdd
SENT: Ukern command: show filter counters
Filter Counters/Policers: Index Packets Bytes Name-------- -------------------- -------------------- -------- 17000 0 __default_arp_policer__ 65280 0 __policer_tmpl__-term 65281 0 __policer_tmpl__-fc0 65282 0 __policer_tmpl__-fc0 65282 0 __policer_tmpl__-fc1 65283 0 __policer_tmpl__-fc0 65283 0 __policer_tmpl__-fc1 65283 0 __policer_tmpl__-fc2 65284 0 __policer_tmpl__-fc0 65284 0 __policer_tmpl__-fc1 65284 0 __policer_tmpl__-fc2 65284 0 __policer_tmpl__-fc3 65285 0 __policer_tmpl__-fc0 65285 0 __policer_tmpl__-fc1 65285 0 __policer_tmpl__-fc2 65285 0 __policer_tmpl__-fc3 65285 0 __policer_tmpl__-fc4 65286 0 __policer_tmpl__-fc0 65286 0 __policer_tmpl__-fc1 65286 0 __policer_tmpl__-fc2 65286 0 __policer_tmpl__-fc3 65286 0 __policer_tmpl__-fc4 65286 0 __policer_tmpl__-fc5 65287 0 __policer_tmpl__-fc0 65287 0 __policer_tmpl__-fc1 65287 0 __policer_tmpl__-fc2 65287 0 __policer_tmpl__-fc3 65287 0 __policer_tmpl__-fc4 65287 0 __policer_tmpl__-fc5 65287 0 __policer_tmpl__-fc6 65288 0 __policer_tmpl__-fc0 65288 0 __policer_tmpl__-fc1 65288 0 __policer_tmpl__-fc2 65288 0 __policer_tmpl__-fc3 65288 0 __policer_tmpl__-fc4 65288 0 __policer_tmpl__-fc5 65288 0 __policer_tmpl__-fc6 65288 0 __policer_tmpl__-fc716777216 0 0 fnp-filter-level-all-1
Non-device ARP drop: 0 >>>>>>>>>HERE this number will increase
*Make sure that there is no proxy-arp in the device otherwise this feature will impact proxy-arp functionality