UNSOLVED
Duplicate MAC addresses appearing, associated with Dell 6224 switch & pings to firewall
Hi, I've been trying to track down what is causing a bunch of pings on my internal network and have finally decided the source must be the Dell 6224. What I'm asking about is 1) Why some of my workstations on the same subnet as my personal machine have the same MAC address as the Dell 6224 and 2) Why the Dell is apparently using a DHCP address to do the pings to the firewall.
Basic Network Diagram: (public IP) WatchGuard Firewall (a.a.a.1)<->(a.a.a.2/29-Vlan100) Dell 6224<-
Mgmt IP b.b.b.2/29 (non routing)
->Vlan200 c.c.c.5/24
->Vlan210 d.d.d.5/24
->Vlan220 e.e.e.5/24
->Vlan230 f.f.f.5/24
Vlan 200 is the main internal subnet.
The switch is using the Layer three capabilities and some ACLs. All internet access is through Vlan100. DHCP relay is enabled to the server on the c.c.c.0/24 subnet.
I started looking when the firewall @ a.a.a.1 was reporting a bunch of pings coming from c.c.c.100, a network address that should be behind the switch. I say should be because I have unplugged everything from the switch except the firewall and am still getting the pings to the firewall. This address is the first address in the DHCP range for the c.c.c.0/24 subnet.
During investigation, I did an "arp -a" on the offending IP address sending the pings and got the MAC address 00:1e:c9:94:41:dd. I then went to the switch to Switching|Address Tables|Dynamic Address Table and found it associated with the Vlanxxx Interfaces and not a port. Each and every vlan interface sported this same MAC address. I then went back to the arp -a that I had done earlier and noted that multiple IP addresses were showing the same MAC address. The c.c.c.5, the routing interface for Vlan200 I understand having the MAC address. But why did three other machines in addition to the pinger @ c.c.c.100 also show the same MAC address? They were .7, .103, & .107. The first is a VMware host machine, the second a standalone PC on the network and the third a guest on the VMware host.
Q1) Why did the .7, .103, .107 show up in response to the arp -a on my personal machines with the MAC address I'm associating with the Dell 6224 and not their own MAC addresses?
Q2) Why is the Dell 6224 using an IP of c.c.c.100 and pinging the firewall?
I hope I've given enough detail, but I'll provide whatever you might need.
Thanks,
-greg
I looked in Routing|ARP|ARP Table Configuration and see the following:
IP MAC Vlan ID Type Age
c.c.c.100 00:00:00:00:00:00 200 Dynamic 00:00:02No MAC address at all for the pinger, not even the switch's.
After I cleared my arp table above and re-pinged c.c.c.100, the arp entry did not show up while all of the other machines did show up.
-greg
These are good questions and the manual doesn't answer them. I have been trying to setup local-proxy-arp to cut down on ARP broadcasts going to a large subnet. I might try to avoid it after reading your post. Proxy ARP a.k.a. the ARP hack is a method of hiding a subnet and is defined in RFC-1027. Local-Proxy-ARP is where the switch answers ARP requests from it's cache and doesn't need to forward the broadcast to all ports.
OuttaCyTE
8 Posts
1775
0
Posted October 25th, 2011 12:00
I think the Q1 answer is "local proxy arp". I set it to off, cleared my arp table on my personal machine, pinged all of the machines again and nothing except c.c.c.5 (the switch) had the MAC address.
So, Q3 is what is "Proxy Arp" vs "Local Proxy Arp". Googling hasn't yielded much and the config guide says nothing.
-greg