Questo sito utilizza cookie di profilazione (propri e di terze parti) per ottimizzare la tua esperienza online e per inviarti pubblicità in linea con le tue preferenze. Continuando a utilizzare questo sito senza modificare le tue preferenze acconsenti all’uso dei cookie. Se vuoi saperne di più o negare il consenso a tutti o ad alcuni cookie clicca qui>
The website that you are visiting also provides Arabian language. Do you wish to switch language version?
يوفر موقع الويب الذي تزوره المحتوى باللغة العربية أيضًا. هل ترغب في تبديل إصدار اللغة؟
The website that you are visiting also provides Russia language Do you wish to switch language version?
Данный сайт есть в английской версии. Желаете ли Вы перейти на английскую версию?
a PC has been connected directly to the USG (simulating that someone wants to reach the destinations in the NAT address pool). USG has 220.127.116.11/24, PC has 18.104.22.168/24.The USG has also a NAT pool configured, containing the address 22.214.171.124. This NAT pool address is not configured on any interface. We ping 126.96.36.199 from the PC to force the PC to send an ARP request.
1) ARP table before ping.
2) ARP table after ping
check if there are drop packet (ARP miss) and increase the counter:
When Internet users send packets to the addresses in the address pool, the FW cannot find matching server-map entries for the packets. Therefore, the FW loops the packets to the router based on the routing table. The router then forwards the received packets to the FW again. As a result, the packets loop between the FW and router. After the time to live (TTL) values in packets decrease to 0, the packets are discarded. If malicious Internet users initiate a large number of connections to addresses in the address pool, the performance of both the FW and router deteriorates.
to not have incomplete arp record and to protect firewall by deteriorating performances:
1) apply black hole routes for all the IP addresses in the NAT pool like this: ip route-static 1.11.100/32 NULL 0
2) Create security policies that deny traffic from untrust -> untrust, with the destination address, the IP`s in the NAT pool. Then the discard reason will not be ARP miss, it will be packet filter discard.