2

This is strange requirement but thought let me ask if some has good advice, so we have Linux iptables firewall with 3 interface, public, Internal and DMZ now we decided to replace linux firewall with Cisco ASA 5585, Its production environment. Plan is to take over IP so i will shutdown Linux firewall and put its IP address on ASA so how much time it will take to flush all ARP cache on entire network? I can change IP address in 1 min but i am not sure how long all system and switches will take to flush their arp table and learn new MAC, all the clients are linux base. any advice?

1
  • 2
    ASA supports MAC cloning/changing on interface and sub-interfaces. It is possible to replicate your Linux firewall's MAC address(es) on the ASA's interface/sub-interfaces as needed with the mac-address command. Makes ARP timeout a non-issue. Existing state/flows in transit would still die out and need to re-establish. Not a recommendation, just another option. cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/…
    – Weaver
    Oct 3 '17 at 2:12
3

E.g. Windows uses 30 seconds for ARP cache timeout. [1]

You might be able to decrease the "dead" time by sending out a gratuitous ARP with the new MAC which the ASA should be doing by itself when changing the IP address, according to [2]:

"When you configure an IP address on the interface, a gratious arp is sent for that IP. If you cycle through all IPs that you use for NAT on the interface, then the other devices get updated for all these addresses."

6
  • do you know how to send GARP?
    – Satish
    Sep 18 '17 at 0:34
  • I've linked a discussion where this is detailed.
    – Zac67
    Sep 18 '17 at 6:30
  • as per second link, it seem there is no manual way but as soon as you put new IP it will broadcast GARP, kinda dangerous but no choice, we have 150 servers across 15 cisco switches.
    – Satish
    Sep 18 '17 at 13:21
  • Not a great solution but wanted to share if someone find it interesting: iuvotech.com/…
    – Satish
    Sep 18 '17 at 14:48
  • Doesn GARP will work if i preconfigure IP address on ASA but keep them shut and later just do no shut does it send GARP?
    – Satish
    Sep 18 '17 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.