3

My sonicwall TZ-210 is answering arp queries on the wan subnet (which my isp doesn't like), basically mapping all the wan ips to its own mac address, causing network havoc since it is not set to route those back to the main isp gateway.

How the heck can I turn this behavior off? I have already entered in all wan subnet ips in the static arp cache and left them 'unpublished' which I presumed would mean that it did not bother answering arp queries for them. Apparently it did not do the trick. Arp queries are still being answered unfortunately.

What can I do? Any suggestions?

Improve this question
9
  • 1
    Reverse whatever you did to turn it on in the first place. That is by no means ordinary behaviour.
    – womble ♦
    Jul 27, 2011 at 23:16
  • 2
    No, I cannot imagine that the default behaviour of any router is to ARP poison everything on a subnet connected to it. If it is, you need to destroy that evil device immediately.
    – womble ♦
    Jul 28, 2011 at 0:06
  • 2
    Burn it! Burn it with FIRE!
    – womble ♦
    Jul 28, 2011 at 1:15
  • 2
    @IsaccB if you just bought the device it should be under warrenty. Contact Sonicwall support and they'll help you. They're great and you only get offshore about 50% of the time, which is a perc.
    – Nixphoe
    Aug 5, 2011 at 15:31
  • 1
    @Miles Erickson- it was SonicOS Enhanced 5.5.1.0-5o
    – IsaacB
    Aug 11, 2011 at 21:21

2 Answers 2

Reset to default
12

I've been stamping these out nationwide, one by one. I've finally found the exact CAUSE of the issue! Yesterday I sat in on a conference call with an IT Tech and SonicWALL. We opened a case and started troubleshooting. We went to the NAT Policies, there is a default Policy on older firmware models called "WAN PRIMARY SUBNET" you want to remove this policy Entirely. SonicWALL is making a change in their next firmware to fix this BUG.

OP edit: You should also flush the ARP cache in the ARP screen after you get rid of the wan primary subnet policies

Improve this answer
6
  • Wow! Didn't expect someone to get the correct answer. Yes, I phoned sonicwall and they told me to disable all nat policies with "wan primary subnet" under "source translated" in the nat policies table. One final step is to flush the arp cache. I tested the fix by arping wan subnet ips with my laptop on the wan side. The fix is legit, it works.
    – IsaacB
    Aug 7, 2011 at 20:03
  • 1
    For the life of me, I never would have guessed that a NAT policy would affect ARP. That is so messed up.
    – IsaacB
    Aug 7, 2011 at 20:09
  • Mike, do you have the case# that was opened up with Sonicwall. This way it can be referenced when tickets are opened.
    – user97438
    Oct 10, 2011 at 21:15
  • @Laura R. -My ticket number was #01658527
    – IsaacB
    Nov 1, 2011 at 23:16
  • Believe it or not these policies still exist in the tz-210 SonicOS Enhanced 5.8.1.5-46o
    – user196188
    Oct 25, 2013 at 3:48
0

Maybe this is a function of the device supporting multiple WAN IP assignments? Some possible considerations:

  • Look into disabling the support of multiple WAN IPs, if only one is in use
  • Consider any possibly of firmware revisions from SonicWall which may behave differently
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .