> Because of problems with our switch not handling both
primary
> and secondary firewalls responding to arp
requests (switch
> would store the last reply
only), I was requested to move my
> proxy-arp IPs
to backup VRRP IPs.
[snip]
> If I pull it out of the VRRP backup, and create a
proxy-arp
> address for it, everything starts
working again. Anyone have
> any clues?
Did you use the VRRP MAC address in your proxy ARP in the
original configuration?
Given your first comment, I'd guess you used the MAC address
of the physical interface in your proxy ARPs ... try changing them to
0:0:5e:0:1:VRRP_ID (and remember, VRRP_ID in the MAC address is hex, whereas
the VRRP ID in shown in Voyager is decimal). Check out Resolution 3324 at the
Nokia support site for more info.
I understand that others have had some success in setting up
multiple backup addresses in lieu of the "standard" proxy ARP + static route
for NATs, but the thought of doing that gives me the willies (they're NATs,
not shared router interfaces, and I don't trust the OS not to do something
peculiar with them).
I have several Nokia HA pairs with lots of NATs and have never
had any issues using the VRRP MAC addr in proxy ARPs.
- Steve
