Last Modified: Sep 13, 2023
Known Affected Versions:
13.1.0, 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 13.1.1, 188.8.131.52, 184.108.40.206, 14.0.0, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 14.0.1, 184.108.40.206, 14.1.0, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 16.1.2, 188.8.131.52, 184.108.40.206, 16.1.3, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 16.1.4
15.0.0, 184.108.40.206, 220.127.116.11
Opened: Dec 13, 2018 Severity: 3-Major
When Proxy ARP is enabled for destination addresses in an FW NAT rule performing destination NAT (static-nat/static-pat), forwarding ICMP traffic matching that rule is incorrectly dropped by AFM instead of being forwarded through the BIG-IP system.
Forwarding ICMP traffic is dropped by the BIG-IP system.
-- Proxy ARP is enabled for destination addresses in an FW NAT rule. -- The BIG-IP system (AFM) receives forwarding ICMP traffic for these (untranslated) destination addresses.
You can disable Proxy ARP functionality for FW NAT rules to cause the BIG-IP system (AFM) to handle forwarding ICMP traffic correctly and pass it through the system to the backend. However, this causes the BIG-IP system to not respond to ARP requests anymore for destination addresses in such rules. As a further mitigation action, you can configure static ARP entries to handle this.
The BIG-IP system (AFM) now correctly forwards ICMP traffic through to the backend when Proxy ARP is enabled on destination addresses in the matching FW NAT rule.