> Source: [sk184896](https://support.checkpoint.com/results/sk/sk184896)

# sk184896 - Proxy ARP uses an incorrect MAC address when the IP was previously assigned to another device

| Property | Value |
|----------|-------|
| Solution ID | sk184896 |
| Date Created | 2026-05-10 |
| Last Modified | 2026-05-10 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- A Security Gateway is configured to respond to Proxy ARP requests for an IP address that is not assigned to a local interface.

The IP address was previously used by another network device, or it is still configured as a Proxy ARP entry elsewhere.

When capturing traffic (`tcpdump` command with the `-nnei` option) on the interface in the same subnet as the Proxy ARP IP, the ARP reply shows a destination MAC address belonging to the previous device, not the Security Gateway.

The same proxy configuration works as expected on ClusterXL.

## Cause

By default, the Linux Operating System does not allow sending ARP packets for non?local IP addresses.

This behavior is controlled by the kernel parameter `net.ipv4.ip_nonlocal_bind.`

On a standalone Security Gateway, this restriction prevents the Gateway from sending Gratuitous ARP packets to update upstream devices. As a result, the upstream device continues to use a stale MAC address for the IP.

In ClusterXL, members automatically send Gratuitous ARP packets for the Virtual IP, which updates the network ARP tables.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content