Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My internet provider is having a lot of trouble with excessive ARP requests coming from a sonicwall TZ-210. I need to tell the sonicwall not to send so many or to send no ARP requests at all from the WAN interface. Does anyone know if this is possible?

So far, it is not looking hopeful. I can't seem to find any options in the web interface to do this.

Any thoughts?



share|improve this question
up vote 3 down vote accepted

I've been stamping these out nationwide, one by one. I've finally found the exact CAUSE of the issue! Yesterday I sat in on a conference call with an IT Tech and SonicWALL. We opened a case and started troubleshooting. We went to the NAT Policies, there is a default Policy on older firmware models called "WAN PRIMARY SUBNET" you want to edit this policy to say "WAN PRIMARY IP" that's it!

SonicWALL is making a change in their next firmware to fix this BUG

share|improve this answer

Here is a very good explanation which may help -

You might look into your SonicWall to see if you can manually populate its WAN interface ARP table. If so, unless you knowing communicate with another ISP customer/subscriber on the same ISP LAN, then a single entry to the upstream gateway should be all that your WAN interface needs.

share|improve this answer
aha. I will look into this. Thanks! – IsaacB Jul 15 '11 at 18:54
Agreed. The firewall shouldn't be ARP'ing at all on the WAN interface except for the upstream node. If it's ARP'ing for internal addresses or anything other than the upstream node on the WAN interface then something's not right. – joeqwerty Jul 15 '11 at 19:00
I guess it's the networks design that allows this. You guys are saying normally there's only one thing that a firewall will try to arp, and that's the gateway address. But in this network its trying to arp all of the other isp's customers. It's some kind of wireless network out in the country. – IsaacB Jul 15 '11 at 19:09
Looks like there is only 127 fake MACS to put in the ARP table. I should count myself lucky. – IsaacB Jul 15 '11 at 19:18
Right. Normally on the WAN interface it should only ARP for the upstream node that is it's DG. The only reason it would ARP for other hosts on the WAN interface is if it needs to send traffic to or respond to another host on the same subnet as the WAN interface, which should never be the case. If it is, there's some kind of funky configuration upstream, such as all of the customers connections being aggregated together (via a switch or WAP) so they're all on the same layer 2 device, layer 3 subnet, and broadcast domain. – joeqwerty Jul 15 '11 at 19:21

I ran into this exact same problem today. Sonicwalls want to handle all of the ARP requests for the wan. I spoke with someone from Sonicwall support today and they told me it was working as designed. Looking from the ISP side, the sonicwall was answering arp requests for every single IP on the subnet that the WAN port was on. Basically the arp table shows that every IP is in use. When you put more than one customer on the same Subnet this becomes a huge problem. I moved the customer to their own small block of ips (5 usable) and I saw 5 arp entries for the sonicwall. The support rep kept asking me "how many ip's are you providing them in your contract". I basically told him it was none of his business and that we were only providing the sonicwall with 1 ip. Apparently they listen for other arp traffic and back off when someone else tries to use one of the IP's.

Long story short, Sonicwalls SUCK.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.