> Source: [sk40283](https://support.checkpoint.com/results/sk/sk40283)

# sk40283 - Static NAT Proxy ARPs don't work after swapping in a new firewall

| Property | Value |
|----------|-------|
| Solution ID | sk40283 |
| Date Created | 2009-04-14 |
| Last Modified | 2009-04-14 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- After swapping in a new firewall connected to a router, static NAT may fail to work. Although the new firewall is configured just like the old one, the static NAT configuration for services such as the mail server or web server are not working, but the hide NAT configuration for internal users seems to work OK.

## Solution

The ARP entries on upstream router need flushing. Some vendors provide an ARP Cache flush command, although, if need be, simply bouncing (turning off and then turning back on) the router will do the trick.

Static NAT requires the configuration of Proxy ARP to support the inbound traffic. Proxy ARP can be configured manually or automatically, depending on the network design, but regardless, the new firewall has new interface MAC addresses and thereforehas new Proxy ARP MAC addresses. The upstream router's ARP cache must be updated.

Unlike many Microsoft Windows based systems, the ARP Cache timeout for most router products is about 4 hours. Thus, it is best to flush or bounce the upstream router after swapping in a new firewall with Static NAT configurations.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content