Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Received ARP request collision from IP inside Adress of a PIX 515

Hi all,

We have a PIX515-DMZ, with the INSIDE adress IP : 10.40.144.2

We notice that we have a lot of errors:

Aug 30 18:25:10 10.40.144.2 Aug 30 2006 18:08:19: %PIX-4-405001: Received ARP request collision from 10.40.144.2/0011.43e1.c5d5 on interface inside

Aug 30 18:25:10 10.40.144.2 Aug 30 2006 18:08:19: %PIX-4-405001: Received ARP response collision from 10.40.144.2/0011.43e1.c5d6 on interface inside

Aug 30 18:25:40 10.40.144.2 Aug 30 2006 18:08:50: %PIX-4-405001: Received ARP request collision from 10.40.144.2/0014.5e6a.428a on interface inside

Aug 30 18:25:40 10.40.144.2 Aug 30 2006 18:08:50: %PIX-4-405001: Received ARP request collision from 10.40.144.2/0011.43e1.c5d5 on interface inside

Aug 30 18:25:41 10.40.144.2 Aug 30 2006 18:08:50: %PIX-4-405001: Received ARP response collision from 10.40.144.2/0011.43e1.c5d6 on interface inside

Aug 30 18:26:15 10.40.144.2 Aug 30 2006 18:09:25: %PIX-4-405001: Received ARP request collision from 10.40.144.2/0014.5e6a.428b on interface inside

Aug 30 18:26:17 10.40.144.2 Aug 30 2006 18:09:26: %PIX-4-405001: Received ARP request collision from 10.40.144.2/0011.43e1.c5d5 on interface inside

Aug 30 18:26:17 10.40.144.2 Aug 30 2006 18:09:26: %PIX-4-405001: Received ARP response collision from 10.40.144.2/0011.43e1.c5d6 on interface inside

Aug 30 18:26:20 10.40.144.2 Aug 30 2006 18:09:30: %PIX-4-405001: Received ARP request collision from 10.40.144.2/0011.43e1.c5d5 on interface inside

Aug 30 18:26:20 10.40.144.2 Aug 30 2006 18:09:30: %PIX-4-405001: Received ARP response collision from 10.40.144.2/0011.43e1.c5d6 on interface inside

I don't know where is the problem with my configuration...

The conf of my PIX is attached.

-----------------

I hope you can help me.

Thanks you by advance for your help!

3 REPLIES

Re: Received ARP request collision from IP inside Adress of a PI

Hi,

This doesn't necessarily mean a problem with your config, if you check the syslog reference for this message you get this:

Error Message: %PIX|ASA-4-405001: Received ARP {request | response} collision from IP_address/MAC_address on interface interface_name

Explanation: The security appliance received an ARP packet, and the MAC address in the packet differs from the ARP cache entry.

Recommended Action: This traffic might be legitimate, or it might indicate that an ARP poisoning attack is in progress. Check the source MAC address to determine where the packets are coming from and check to see if it belongs to a valid host.

HTH

Andrew.

New Member

Re: Received ARP request collision from IP inside Adress of a PI

Hi,

Thanks your for your answer but:

Received ARP request collision from 10.40.144.2/0011.43e1.c5d5 on interface inside

The IP address which makes the ARP request collision (10.40.144.2) is the IP adress of my Inside Interface of this PIX...

I don't understand, the PIX receives ARP collision from itself?!...

Thanks.

New Member

Re: Received ARP request collision from IP inside Adress of a PI

Other information :

My inside interface is directly connected to a Server's VLAN. And most of the servers have 2 NICS... Maybe my issue stems from this point?

Thanks you by advance for your help

3596
Views
0
Helpful
3
Replies
CreatePlease to create content