If you have a Sonicwall NSA 2400 or TZ150 (this may effect other Sonicwall models as well) and a Verizon FIOS line, you may find that the Internet goes down every six hours or so and you have to reboot the firewall to restore Internet access. This can happen if your Sonicwall is configured with more than one external IP address and because of the way FIOS handles it's ARP broadcasts. Here are the possible workarounds:
- Configure the Sonicwall with a single static IP address and use NAT Port Service remapping to share a single external IP address and complete the ARP changes in item 3.3 below.
- OR
- Add in a static route that includes the unused external IP addresses on the firewall.
- FIOS IP Block Network Object. Under Network, Address Objects, create an Address Object range that includes your usable static block, but excludes the IP address of your Sonicwall WAN Interface.
- Name: FIOSStaticIPs
- Zone Assignment: WAN
- Type: Range
- Starting IP Address: <FIOS IP Block Start Range excluding your WAN IP Address>
- Ending IP Address: <FIOS IP Block End Range>
- Static Route. Under Network, Routing, add in a route policy for the network object you just created.
- Source: Any
- Destination: FIOSStaticIPs
- Service: Any
- Gateway: 0.0.0.0
- Interface <FIOS WAN Interface usually X1>
- Metric: 20
- Change the ARP Settings on the Sonicwall.
- Go to <ip adress of the sonicwall>/diag.html and click on Internal Settings.
- Under the ARP Settings check the following boxes:
- Enable ARP bridging
- Enable open ARP behavior (WARNING: Insecure!!)
- Limit ARPS of non-responsive IPs.
After you add this static route and modify the ARP settings, you should be able to use all of the external IP addresses in your static block and not have the firewall go down every six hours. Changing these ARP settings on the Sonicwall will make you more vulnerable to an ARP Poisoning attack. Your static block range must exclude any IP address that are assigned to physical interfaces. The Internet will go down without the Static route and ARP changes because of the way the FIOS network is built. The Verizon network sends ARP requests from 0.0.0.0 (an unknown network) and the Sonicwall drops these packets because it thinks it's an ARP cache poisoning attempt. Because the Sonicwall does not reply to these requests, Verizon FIOS thinks nothing is connected to the static block and drops the connection after six hours.