I've seen this type of behavior before with HA configs. Usually, the cause
is both HA devices responding with the same MAC (for HA purposes). If the
switches don't like it, they can go into a blocking mode to figure out which
port the HA MAC address should appear. Check that first. You may have to
disable whatever Foundry's spantree equivalent is for the ports connected to
the PIX devices.
--
Rebecca Kastl
Network Systems Engineer
INS (Phoenix, AZ)
_____
From: Jason Ha [mailto:JHa@verisign.com.au]
Sent: Tuesday, November 16, 2004 2:57 PM
To: firewalls@securityfocus.com
Subject: PIX / Foundry not responding to ARP requests?
Hey Gang,
Interesting one for you.
Have a customer who is experiencing some difficulty with their setup. There
have a pair of PIX firewalls in HA, connected to a pair of Foundry Server
Iron switches with servers connected off the various switch ports.
Apparently, intermittently, they claim the PIX will not respond to ARP
requests for its own interface connected on that network. As a result, the
servers which are setup to fail over in the event that they can't ping the
default gateway (the PIX's interface) will failover and as a result, active
sessions will be dropped.
We have done rigorous debugging on the PIX and can't seem to see it drop any
ARP requests, and in fact, it responds to every ARP requests within
microseconds. The customer is adamant that it is the PIX, but my guess is
more towards the Foundry Switches.
Has anyone seen a similar setup to this?
Any feedback is appreciated.
Thanks heaps.
Regards,
Jason Ha [CISSP]
Senior Security Engineer,
Security Operations Centre
VeriSign Australia
