Specifically the problem relates to remotely administering the switches through a clustered firewall (stonegate) which uses a multicast HW address. We were able to manually set the m.a.t for the layer-2 switching so that both nodes receive the traffic directed to the cluster address, and no traffic is flooded, however the IOS' are unable to learn the cluster address when the switches themselves do an ARP WHO-HAS for the cluster's IP address (ie when someone accesses the switch itself via the firewall).
A snoop of the traffic going between switch and FW cluster node reveals that the switch sends an ARP WHO-HAS for the IP address, gets an ARP REPLY with the correct MAC address, but immediately does another query and repeats this until the ping (or whatever) fails.
Evidently, the switches are not learning the MAC address properly so we tried manually creating an ARP entry for this address. Unfortunately, it does not seem to be possible to specify a VLAN. Using the command (from enable config):
ARP X.X.X.X 0103.5600.1400 ARPA VLAN NNN
produces the following error:
Bad ARP command - Interface may only be specified when bridging IP
If we remove the VLAN parameter the command works and the address is entered into the ARP cache, but the arp entry does not work - any attempt to reach the specified host results in no visible IP packets whatsoever on the VLAN where it resides.
Obviously we need to get a handle on this problem as we currently have to specify the underlying nodes' IP address as default gateway in order to reach the switches at all, and this is a clustered firewall where the active node changes all the time. We need to either force the switch to learn the mac address automatically using ARP WHO-HAS queries, or get a working static ARP entry that will route the traffic to the correct VLAN. Anyone who's found a workaround or fix for this problem, please drop a line here (and don't hesitate to mail either - oas@zonavi.com will do nicely)
Regards,
Ole Andre Schistad
Systems Manager.
We then tried to enter the address manually into the ARP cache, using the
