Cannot use Automatic ARP in a VRRP or IP Clustering configuration When using static NAT in a Nokia FW-1 cluster, you can't let FW-1 use Automatic ARP Configuration (which is the default in the NAT global property). If you do, then it associates the static addresses with the MAC addresses of the physical interfaces.
This means that both the active and the standby firewall will be advertising the static IP addresses, which will cause sporadic asymetric routing and drops.
To fix this, you need to turn off the Automatic ARP Configuration and explicitly associate each static NAT IP with the VRRP MAC address (which you can see from doing ifconfig -a on the active firewall) in the Voyager ARP configuration.
Regenerating the policy and rebooting the firewalls may also be required.
To see whether the change has taken effect, use something like the following, where eth-s1p1 is our external interface and
StaticIP? the IP to be tested: tcpdump -i eth-s1p1 -e host StaticIP--
PhoneBoy - 01 Jan 2004
FAQForm FAQs.Class:
NetworkAddressTranslationFAQs,
TroubleshootingFAQs FAQs.OS:
OsNokiaIPSO FAQs.Version:
Cannot use Automatic ARP in a VRRP or IP Clustering configuration 
2005-08-14 
Cannot use Automatic ARP in a VRRP or IP Clustering configuration 
Linear Mode
