Received conflicting ARP on interface ethernetX/X indicating duplicate IP Y.Y.Y.Y
61256
Created On 11/14/19 03:49 AM - Last Modified 06/14/24 05:25 AM
Symptom
- Receiving conflicting ARP log messages on an interface on the firewall.
- Eg, Received conflicting ARP on interface ethernet1/1 indicating duplicate IP 172.16.0.58, sender mac 00:50:56:9b:71:fe
Monitor > Logs > System
Environment
- Next Generation Firewall
- PAN-OS 9.1 and above
- Topology:
Cause
The same IP address was used twice in the network either by:
1. Assigning the same IP on both devices.
2. Assigning the same IP as a SNAT (Source NAT) address facing the internet.
3. Assigning the same IP as a DNAT (Destination NAT) address facing the internet.
4. Assigning a SNAT (Source NAT) pool, where the concerned IP is part of the pool.
Resolution
- Cause: Assigning the same IP on both devices
Resolution: Configure the appropriate IP address on the interface
- Cause: Assigning the same IP as a SNAT (Source NAT) address facing the internet
- Cause: Assigning the same IP as a DNAT (Destination NAT) address facing the internet
Resolution: Configure a different IP address for the DNAT (Destination NAT)
- Cause: Assigning a SNAT (Source NAT) pool, where the concerned IP is part of the pool
Resolution: Configure a SNAT pool instead of using the slash (/) notation
Additional Information
Looking into the issue with help of packet capture :
- Create a packet filter based on the interface where the duplicate IP address is seen, from Monitor > Packet Capture > Configure Filtering > Manage Filters
In our example we'll just ethernet1/1 (as seen from our Topology above), under Non-IP
column forget not to use "include" for us to capture the ARP exchange between the two devices
- Configure the appropriate stages and their corresponding file name:
- Generate the ARP request by using the ping tool:
ping source 172.16.0.201 host 172.16.0.58
- Download and merge R.pcap and T.pcap together and use wireshark filter 'arp' :
- Interpreting packet capture:
- Frame 9, Firewall sends out an ARP request broadcast on who is the owner of IP: 172.16.0.58.
- Frame 10, Router informed Firewall that 172.16.0.58 has the MAC address of 00:58:56:9b:71:fe (which is his own MAC).
- Frame 11, Firewall overwritten the ARP reply from Frame 10, which shouldn't be, this is the part where the firewall will generate the log for duplicate IP.
In addition to the above, please refer to Techdoc that explains the above from another perspective: Proxy ARP for NAT Address Pools