My sonicwall TZ-210 is answering arp queries on the wan subnet (which my isp doesn't like), basically mapping all the wan ips to its own mac address, causing network havoc since it is not set to route those back to the main isp gateway.

How the heck can I turn this behavior off? I have already entered in all wan subnet ips in the static arp cache and left them 'unpublished' which I presumed would mean that it did not bother answering arp queries for them. Apparently it did not do the trick. Arp queries are still being answered unfortunately.

What can I do? Any suggestions?

  • 1
    Reverse whatever you did to turn it on in the first place. That is by no means ordinary behaviour. – womble Jul 27 '11 at 23:16
  • 2
    No, I cannot imagine that the default behaviour of any router is to ARP poison everything on a subnet connected to it. If it is, you need to destroy that evil device immediately. – womble Jul 28 '11 at 0:06
  • 2
    Burn it! Burn it with FIRE! – womble Jul 28 '11 at 1:15
  • 2
    @IsaccB if you just bought the device it should be under warrenty. Contact Sonicwall support and they'll help you. They're great and you only get offshore about 50% of the time, which is a perc. – Nixphoe Aug 5 '11 at 15:31
  • 1
    @Miles Erickson- it was SonicOS Enhanced – IsaacB Aug 11 '11 at 21:21

I've been stamping these out nationwide, one by one. I've finally found the exact CAUSE of the issue! Yesterday I sat in on a conference call with an IT Tech and SonicWALL. We opened a case and started troubleshooting. We went to the NAT Policies, there is a default Policy on older firmware models called "WAN PRIMARY SUBNET" you want to remove this policy Entirely. SonicWALL is making a change in their next firmware to fix this BUG.

OP edit: You should also flush the ARP cache in the ARP screen after you get rid of the wan primary subnet policies

  • Wow! Didn't expect someone to get the correct answer. Yes, I phoned sonicwall and they told me to disable all nat policies with "wan primary subnet" under "source translated" in the nat policies table. One final step is to flush the arp cache. I tested the fix by arping wan subnet ips with my laptop on the wan side. The fix is legit, it works. – IsaacB Aug 7 '11 at 20:03
  • 1
    For the life of me, I never would have guessed that a NAT policy would affect ARP. That is so messed up. – IsaacB Aug 7 '11 at 20:09
  • Mike, do you have the case# that was opened up with Sonicwall. This way it can be referenced when tickets are opened. – user97438 Oct 10 '11 at 21:15
  • @Laura R. -My ticket number was #01658527 – IsaacB Nov 1 '11 at 23:16
  • Believe it or not these policies still exist in the tz-210 SonicOS Enhanced – user196188 Oct 25 '13 at 3:48

Maybe this is a function of the device supporting multiple WAN IP assignments? Some possible considerations:

  • Look into disabling the support of multiple WAN IPs, if only one is in use
  • Consider any possibly of firmware revisions from SonicWall which may behave differently

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.