Bug ID 753028: AFM drops forwarding ICMP traffic matching FW NAT rule for Dest NAT that also has Proxy ARP enabled for destination addresses in the rule

Last Modified: May 29, 2024

Affected Product(s):
BIG-IP AFM(all modules)

Known Affected Versions:
13.1.0,,,,,,,,, 13.1.1,,, 14.0.0,,,,,, 14.0.1,, 14.1.0,,,,, 16.1.2,,, 16.1.3,,,,,, 16.1.4,,,

Fixed In:

Opened: Dec 13, 2018

Severity: 3-Major


When Proxy ARP is enabled for destination addresses in an FW NAT rule performing destination NAT (static-nat/static-pat), forwarding ICMP traffic matching that rule is incorrectly dropped by AFM instead of being forwarded through the BIG-IP system.


Forwarding ICMP traffic is dropped by the BIG-IP system.


-- Proxy ARP is enabled for destination addresses in an FW NAT rule. -- The BIG-IP system (AFM) receives forwarding ICMP traffic for these (untranslated) destination addresses.


You can disable Proxy ARP functionality for FW NAT rules to cause the BIG-IP system (AFM) to handle forwarding ICMP traffic correctly and pass it through the system to the backend. However, this causes the BIG-IP system to not respond to ARP requests anymore for destination addresses in such rules. As a further mitigation action, you can configure static ARP entries to handle this.

Fix Information

The BIG-IP system (AFM) now correctly forwards ICMP traffic through to the backend when Proxy ARP is enabled on destination addresses in the matching FW NAT rule.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips