cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
856
Views
0
Helpful
5
Replies

ASA syslog message

saidfrh
Level 1
Level 1

The firewall syslog message shows "..Received ARP response collision from 10.168.1.254/001d.e6f2.f7c0 on interface Inside. I can not see any documentation for 10.168.1.254/001d.e6f2.f7c0. Any suggestions on how to track the IP/mac address? Thanks

2 Accepted Solutions

Accepted Solutions

Firstly - what device on your network has the address 10.168.1.254?

Secondly - have you traced the device that has MAC address 001d.e6f2.f7c0

Arp collisions are - interesting, to fully understand why you are seeing them, you need to know the answer to the above questions?

View solution in original post

the link below describes the password recovery procedure for the Cisco Catalyst switches you are using. you will need to Power the switch and bring it to the switch: prompt so yes the password recovery will affect production so i suggest you do it out of work hours

http://www.cisco.com/en/US/products/hw/switches/ps628/products_password_recovery09186a0080094184.shtml

View solution in original post

5 Replies 5

andrew.prince
Level 10
Level 10

Well that mac address is a Cisco mac address - so I would check your configuration on your layer 3 devices!

To track it down - in your core router:-

show arp | inc 001d.e6f2.f7c0 or show arp | inc 10.168.1.254

HTH.

Do you know why there would be a ARP response collision?

05-26-2008 09:06:55 Local4.Warning 10.168.1.10 May 26 2008 09:10:56: %ASA-4-405001: Received ARP response collision from 10.168.1.254/001d.e6f2.f7c0 on interface Inside

Thanks

Firstly - what device on your network has the address 10.168.1.254?

Secondly - have you traced the device that has MAC address 001d.e6f2.f7c0

Arp collisions are - interesting, to fully understand why you are seeing them, you need to know the answer to the above questions?

Why would the firewall log a ARP response collision? I believe the IP may be associated with Cisco switches: 2 x 2960G and 3560G. We are on one network/subnet. I recently configured a network 2 months ago and forgot where I documented the passwords to the switches and if I assigned IPs to the switches. Any suggestions to password recovery on the switches? Would password recovery procedure on the switches effect production environment? Thanks.

the link below describes the password recovery procedure for the Cisco Catalyst switches you are using. you will need to Power the switch and bring it to the switch: prompt so yes the password recovery will affect production so i suggest you do it out of work hours

http://www.cisco.com/en/US/products/hw/switches/ps628/products_password_recovery09186a0080094184.shtml

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: