IP Pool ARP Issue

[Brian_T]

I have confirmed that in v4.0,build0178,090820 (MR1) any entry created in the Virtual IP / IP Pool section will automatically send a gratuitous ARP for the defined address and will supercede any other arp entry on the network. This happens regardless of the IP Pool beoing used in any rule. We are trying to run Checkpoint and Forigate in parrallel until we have completed our migration to Fortinet but it redirects all traffic through the Fortigate because of entries brought over from the Checkpoint in the IP Pool definitions. I have taken out the IP Pools and do not se the gratuitous ARPs in my wireshark traces. Is this a bug or by design?

[red_adair]

IPPool shouldn' t send GARPs. But VIP may so if configured. # conf fire vip # edit <yourvip> get name : <yourvip> id : 0 comment : (null) type : static-nat extip : 0.0.0.0 extintf : wan1 arp-reply : enable nat-source-vip : disable portforward : enable gratuitous-arp-interval: 0 <<<---------------------------- mappedip : 11.22.33.44 protocol : tcp extport : 8080 mappedport : 80 gratuitous-arp-interval interval between sending gratuitous arps (seconds)(0 to disable) tree firewall vip -- [vip] --*name (64) |- id (0,65535) |- comment (64 xss) |- type |- ldb-method |- extip |- mappedip |- extintf (36) |- arp-reply |- server-type |- persistence |- nat-source-vip |- portforward |- protocol |- extport (1,65535) |- mappedport |- gratuitous-arp-interval (0,0) |- [realservers] -- ip |- port (1,65535) |- status |- weight (1,255) |- holddown-interval (0,0) |- healthcheck |- max-connections (0,2147483647) |- monitor (64) +- client-ip |- http-cookie-domain (36) |- http-cookie-path (36) |- http-cookie-generation (0,0) |- http-cookie-age (0,525600) |- http-cookie-share |- http-multiplex |- http-ip-header |- outlook-web-access |- monitor (64) +- max-embryonic-connections (0,100000)

[Brian_T]

We do not have any VIPs defined, only IP Pools. Can they be configured to disable g-arps as well? WOuld be nice to be able to configure everything on the Fortinet platform before cutover and onlt actovate what we need.