Cisco Support Community
Community Member

Replacing Faulty PIX FW / Clear ARP?


I'm curious to find out what goes on as far as communications between a local host and a router is concerned when the arp cache of a router has two instances of the same MAC address but different IP address. What would happen to local hosts wanting to go out to the internet?

sho arp


Internet 2 0001.64ff.ce99 ARPA

Internet 3 0001.64ff.ce99 ARPA

Recently i replaced a faulty primary firewall ( with the backup firewall ( The backup firewall, after rebooting, assumed the primary role which resulted in a new IP address of (but new MAC). This resulted in the anomaly of the arp cache. Right now no traffic is allowed in or out of the new PIX. I assume it's because of the above arp problem. Hopefully a clear arp-cache will resolve the issue.




Re: Replacing Faulty PIX FW / Clear ARP?

I'm not too sure you should be seeing what you are seeing. The secondary firewall in the failover pair should take over the primary's IP and MAC when it goes active. However, assuming that we end up with the an arp table as shown above, there is still no problem since all traffic destined to will be forwarded correctly since the IP is mapped to the correct L2 address. Also, all hosts will still be forwarding traffic to the primary's IP of and the failover unit has taken up the primary's IP and mac.

CreatePlease to create content