How to Configure Static ARP on the Palo Alto Networks Firewall
96750
Created On 09/25/18 17:36 PM - Last Modified 01/30/25 22:16 PM
Environment
- Any PAN-OS.
- Palo Alto Firewall.
Procedure
Overview
Static ARP (Address Resolution Protocol) entries reduce ARP processing and preclude man-in-the-middle attacks for the specified addresses.
Steps
Navigate to the ARP entry configuration:
- On the WebGUI, go to Network > Interfaces > Ethernet.
- Select the appropriate L3 interface.
- Click Advanced.
- Click ARP Entries.
- Click Add and add the desired entry.
- Click OK and commit the configuration.

From the CLI:
> configure
# set network interface ethernet ethernet1/5 layer3 arp 10.101.10.10 hw-address F0:1F:AF:02:96:36
# commit
Note: It's not possible to change the Palo Alto Networks interface MAC address.