S9712交换机配置问题导致直连防火墙Ping不通交换机的故障

1、组网信息：

分布层采用两台高性能路由交换机S9712，上联、互联均采用2×GE光口跨板捆绑，接入层交换机通过GE双归接入。出口部署防火墙，保证本分区和其它功能区的互访有安全控制，采用旁挂方式，上下联均采用2GE光口跨板捆绑。

2、S9712设备信息：

无

1、先做防火墙主备倒换测试，将备墙切到主墙后，主墙ping交换机虚地址不通，主墙上报文头分析确认已经发出去了；在主交换机上匹配icmp报文做流量统计，能收到主墙发的ping请求报文，但是没有回应报文发出去。
<NM1_LU_DS_01>dis traffic policy statistics interface Eth-Trunk 3 inbound Interface: Eth-Trunk3
Traffic policy inbound: test-in
Rule number: 1
Current status: OK!
---------------------------------------------------------------------
 Board : 8
Item                              Packets                       Bytes
---------------------------------------------------------------------
Matched                                 0                           0
  +--Passed                             0                           0
  +--Dropped                            0                           0
    +--Filter                           0                           0
    +--CAR                              0                           0
 Board : 9
Item                              Packets                       Bytes
---------------------------------------------------------------------
Matched                                 5                         510
  +--Passed                             5                         510
  +--Dropped                            0                           0
    +--Filter                           0                           0
    +--CAR                              0                           0
<NM1_LU_DS_01><NM1_LU_DS_01>dis
traffic policy statistics interface Eth-Trunk 3 outbound 
 Interface: Eth-Trunk3
 Traffic policy outbound: test-out
 Rule number: 1
 Current status: OK!
---------------------------------------------------------------------
 Board : 8
Item                              Packets                       Bytes
---------------------------------------------------------------------
Matched                                 0                           0
  +--Passed                             0                           0
  +--Dropped                            0                           0
    +--Filter                           0                           0
    +--CAR                              0                           0
 Board : 9
Item                              Packets                       Bytes
---------------------------------------------------------------------
Matched                                 0                           0
  +--Passed                             0                           0
  +--Dropped                            0                           0
    +--Filter                           0                           0
    +--CAR                              0                           0
2、在主交换机上查看arp学习到互连口eth-trunk1上，没有刷新到与主墙的互连口eth-trunk3上。

<NM1_LU_DS_01>dis arp int vl 814

IP   ADDRESS      MAC ADDRESS     EXPIRE(M) TYPE        INTERFACE   VPN-INSTANCE

                                         VLAN/CEVLAN

------------------------------------------------------------------------------
11.139.69.217   cc53-XXXX-4895            I -         Vlanif814
11.139.69.221   0009-XXXX-3e59  13       D-0         Eth-Trunk1

                                          814/-

                                          814/-
------------------------------------------------------------------------------
Total:3         Dynamic:2       Static:0     Interface:1   

arp anti-attack entry-check fixed-all enable

                                         VLAN/CEVLAN

                                          814/-

                                          814/-

                                          814/-

主墙升级重启后业务切换到备墙，汇聚主交换机与主墙的互连口eth-trunk3 down，在汇聚主交换机上与备交换机的互连口eth-trunk1学习到防火墙的虚地址。备防火墙升级重启切换到主墙，此时汇聚主交换机与备交换机的互连口是up的，由于设备上配置了arp固化，主墙发到主交换机的免费arp被主交换机判断是攻击，将防火墙的arp地址固化到与备交换机的互连口，所以arp无法刷新到与主墙的互连口eth-trunk3，导致不通。
经过了解，早期存在用户乱配置IP地址的情况，当时为了防止用户随意配置IP地址影响业务，通过配置arp固化解决，后来一直没有删除。

删除arp固化命令。
Undo arp anti-attack entry-check fixed-all enable