PIX 501 - ARP cache

[Richard-MARIE]

We are currently having a trouble on a PIX 501:

The test is as follows:
On a server, PING in LAN and through a tunnel or IPSec VPN Client is OK
If we change the IP address of this server PING in LAN is OK (on this new address) but not VPN.

After a reboot of the PIX, the PING is OK and IPSEC LAN.

Have you ever encountered a similar problem, the PIX is defective?

[Kimberly Adams]

Richard,

When the IP change happens, then you will need to clear arp on the firewall.  The default timeout of the arp casche is 4 hours, if my memory serves me.  This is a common problem I have encountered before.  What version of code are you running on the PIX?

Thanks,

Kimberly