This is strange requirement but thought let me ask if some has good advice, so we have Linux iptables firewall with 3 interface, public, Internal and DMZ now we decided to replace linux firewall with Cisco ASA 5585, Its production environment. Plan is to take over IP so i will shutdown Linux firewall and put its IP address on ASA so how much time it will take to flush all ARP cache on entire network? I can change IP address in 1 min but i am not sure how long all system and switches will take to flush their arp table and learn new MAC, all the clients are linux base. any advice?
-
2ASA supports MAC cloning/changing on interface and sub-interfaces. It is possible to replicate your Linux firewall's MAC address(es) on the ASA's interface/sub-interfaces as needed with the mac-address command. Makes ARP timeout a non-issue. Existing state/flows in transit would still die out and need to re-establish. Not a recommendation, just another option. cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/…– WeaverOct 3, 2017 at 2:12
Add a comment
|
1 Answer
E.g. Windows uses 30 seconds for ARP cache timeout. [1]
You might be able to decrease the "dead" time by sending out a gratuitous ARP with the new MAC which the ASA should be doing by itself when changing the IP address, according to [2]:
"When you configure an IP address on the interface, a gratious arp is sent for that IP. If you cycle through all IPs that you use for NAT on the interface, then the other devices get updated for all these addresses."
-
-
-
as per second link, it seem there is no manual way but as soon as you put new IP it will broadcast
GARP, kinda dangerous but no choice, we have 150 servers across 15 cisco switches.– SatishSep 18, 2017 at 13:21 -
Not a great solution but wanted to share if someone find it interesting: iuvotech.com/…– SatishSep 18, 2017 at 14:48
-
Doesn
GARPwill work if i preconfigure IP address on ASA but keep themshutand later just dono shutdoes it sendGARP?– SatishSep 18, 2017 at 14:51