Bug ID 753028: AFM drops forwarding ICMP traffic matching FW NAT rule for Dest NAT that also has Proxy ARP enabled for destination addresses in the rule

Last Modified: Jan 06, 2020

Bug Tracker

Affected Product:  See more info
BIG-IP AFM(all modules)

Known Affected Versions:
13.1.0,,,,,,,,, 13.1.1,,,, 14.0.0,,,,,, 14.0.1,, 14.1.0,,,,,

Fixed In:

Opened: Dec 13, 2018
Severity: 3-Major


When Proxy ARP is enabled for destination addresses in an FW NAT rule performing destination NAT (static-nat/static-pat), forwarding ICMP traffic matching that rule is incorrectly dropped by AFM instead of being forwarded through the BIG-IP system.


Forwarding ICMP traffic is dropped by the BIG-IP system.


-- Proxy ARP is enabled for destination addresses in an FW NAT rule. -- The BIG-IP system (AFM) receives forwarding ICMP traffic for these (untranslated) destination addresses.


You can disable Proxy ARP functionality for FW NAT rules to cause the BIG-IP system (AFM) to handle forwarding ICMP traffic correctly and pass it through the system to the backend. However, this causes the BIG-IP system to not respond to ARP requests anymore for destination addresses in such rules. As a further mitigation action, you can configure static ARP entries to handle this.

Fix Information

The BIG-IP system (AFM) now correctly forwards ICMP traffic through to the backend when Proxy ARP is enabled on destination addresses in the matching FW NAT rule.

Behavior Change