Take the 2-minute tour ×

Occasionally, I stop being able to access our Exchange server from my PC. Just my PC - everyone else carries on without incident, but I can't ping the Exchange box, log in with Outlook or get to the OWA page (also hosted on the same server).

This behaviour would persist for a few minutes, or until I rebooted. Based on that, I grabbed a copy of my ARP cache while the Exchange box was being unresponsive (to me, anyway), to discover that the MAC address of the Exchange box (Exchange 2007, running on VMWare) had been replaced by that of the LAN interface on our firewall.

Clearing the ARP and DNS caches resolved the problem, but I've got no idea why this is happening in the first place - my PC and the Exchange box are both on the same subnet and the default gateway is another address entirely, so the firewall (a PIX 515E) shouldn't see any Exchange-bound traffic from my PC in the first place, much less be answering ARP requests for the Exchange server.

It's not a major problem now that I know what's going on, but it's baffling the hell out of me. Does anyone have any idea what might be going on here?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

It sounds like a problem with proxy ARP at the firewall (even though it shouldn't). I'm assuming the Pix is doing proxy ARP for the Exchange server for inbound traffic from the internet. For some reason it sounds like the firewall is doing proxy ARP for internal traffic as well. When the problem occurs, try running a tracert to the internal ip address of the Exchange server and see if it's going through the firewall for some reason.

share|improve this answer
That sounds promising - a quick Google for "pix 515 proxy arp" reveals all sorts of variations on that problem. Will investigate further. –  RainyRat Dec 14 '09 at 16:20
Keep us posted on what you find out. –  joeqwerty Dec 14 '09 at 16:22
OK, a tracert to the IP just times out (unsurprisingly, since that IP isn't located at that MAC and hence can't reply). I've turned proxy ARP off for the inside network, and the problem has yet to re-appear. Thanks for the pointer. –  RainyRat Dec 17 '09 at 10:42
Glad to help and glad you got it sorted out. –  joeqwerty Dec 17 '09 at 12:18
Don't know if I've sorted it, I just haven't broken it any worse :) –  RainyRat Dec 17 '09 at 17:02
show 1 more comment

Your Answer


