> Source: [sk1000074](https://support.checkpoint.com/results/sk/sk1000074) # sk1000074 - Maestro Security Group Displays ARP Consistency Diagnostic Warning | Property | Value | |----------|-------| | Solution ID | sk1000074 | | Date Created | 2026-08-26 | | Last Modified | 2026-08-27 | | Technical Level | General | | Products | Scalable Platforms | | Versions | R81.20 | | OS | Gaia | | Platform | 7000, 9000, Maestro Orchestrator | ## Symptoms - * When an administrator logs in to the Maestro Security Group, the login banner displays this warning: ```text System diagnostics failed on the following tests: ARP Consistency. ``` * The `asg diag verify` command reports a failure in the **Networking** section for **Address Resolution Protocol (ARP) Consistency**. ```text ARP Consistency: ============================== Address HWtype HWaddress Flags Mask Iface SGMs 10.2.12.1 ether 00:00:0c:9f:f2:11 C bond4 1_01,1_02,1_03,1_04 10.3.26.6 ether 42:33:aa:b7:92:2f C bond9.6 1_01,1_02,1_03,1_04 10.4.20.166 ether 66:71:cb:3c:32:ba C bond9.5 1_01,1_02,1_03,1_04 10.4.240.234 ether 43:cd:90:3f:ff:51 C bond9.5 1_01 10.5.244.36 . (incomplete) . bond9.5 1_02 10.5.244.36 ether f3:d4:ae:22:97:15 C bond9.5 1_01,1_03,1_04 MAC address for IP 10.5.244.36 is inconsistent across the SGMs ``` * ARP table comparison across Security Group Members (SGMs) shows inconsistent or incomplete ARP entries for the same Internet Protocol (IP) addresses. * For example, one SGM shows an incomplete ARP entry for an IP address, while other SGMs show a resolved Media Access Control (MAC) address for the same IP address. ## Cause The ARP Consistency failure occurred because ARP information was not identical across all Maestro Security Group Members (SGMs). Some SGMs had incomplete or stale ARP entries, while other SGMs had resolved MAC addresses for the same client IP addresses. This condition can occur when client IP and MAC assignments change dynamically in the environment, and the ARP update has not yet propagated or synchronized across all SGMs. If no configuration issue was confirmed, the stale or incomplete ARP entries may time out or be synchronized across the Maestro Security Group, and the diagnostic warning disappear. ## Solution The first solution is to wait for the ARP table entries to time out. The second solution is to force the entries to timeout and have the host respond to a new ARP request. 1. **Verify the ARP Consistency failure on the Maestro Security Group:** * Connect to the Maestro Security Group command line. * Run the diagnostic verification command from Expert Mode: ```bash asg diag verify ``` * Confirm that the failure appears under the **Networking** section for **ARP Consistency**. 1. **Compare ARP entries across all Security Group Members:** * On the Maestro Security Group, run: ```bash g_all arp -an ``` * Look for the affected IP addresses. * Confirm whether one or more SGMs show an incomplete ARP entry while other SGMs show a resolved MAC address. 1. **If the issue persists, clear the stale ARP entry:** * **Warning:** Clearing an ARP entry can cause an outage for that host. Clearing the full ARP table will cause all hosts to see a disruption in traffic. Only delete entries during a change window. Preferably, clear only the affected ARP entries. Do not flush the full ARP table unless Check Point Support instructs you to do so. * On the Maestro Security Group, delete the affected ARP entry from all SGMs: ```bash g_all arp -d ``` * Example: ```bash g_all arp -d 10.5.244.36 ``` * If only one SGM has the incomplete entry, connect to that specific SGM context and delete only the affected ARP entry: ```bash arp -d ``` 1. **Regenerate the ARP entry:** * From the Maestro Security Group, send traffic to the affected host from all SGMs thus causing host to provide an ARP reply: ```bash g_all ping -c 3 ``` * Example: ```bash g_all ping -c 3 10.5.244.36 ``` 1. **Verification step:** * Recheck the ARP table on all SGMs: ```bash g_all arp -an ``` * Confirm that all SGMs show consistent ARP information for the affected IP addresses. * Run the diagnostic verification command again: ```bash asg diag verify ``` * Confirm that **ARP Consistency** no longer reports a failure. * Log out and log in again to confirm that the login warning no longer appears. ### **References**
* [sk182845 - ARP resolution workflow on Quantum Maestro](https://support.checkpoint.com/results/sk/sk182845) * [sk184841 - BMAC VMAC verify diagnostic test fails on Maestro VSX Security Group](https://support.checkpoint.com/results/sk/sk184841) * [sk184857 - ARP Packets Contain Invalid MAC Address](https://support.checkpoint.com/results/sk/sk184857)
--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content