>
    Strata Copilot
    Verify Proxy ARP and DHCP Relay Overwrite
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Proxy ARP and DHCP Relay Overwrite
    4. Verify Proxy ARP and DHCP Relay Overwrite
    Download PDF
    Next-Generation Firewall

    Verify Proxy ARP and DHCP Relay Overwrite

    Table of Contents

    Verify Proxy ARP and DHCP Relay Overwrite

    Confirm that Proxy ARP is intercepting ARP requests and that security policy is enforcing traffic between devices on the VLAN.
    Where Can I Use This?What Do I Need?
    • NGFW
    • PAN-OS 12.2.2 or a later release
    • One of these licenses when using Strata Cloud Manager
      • Strata Cloud Manager Essentials
      • Strata Cloud Manager Pro
    After you configure Proxy ARP, verify that the firewall is responding to ARP requests, similarly after DHCP relay overwrite is configured verify subnet mask and gateway values are overwritten.
    1. (On the CLI) Test whether Proxy ARP responds to ARP requests for a specific device IP address.
      test proxy-arp interface <interface-name> target-ip <ip-address>
      The output Proxy ARP entry found - proxy ARP will respond for this address confirms the firewall intercepts ARP requests for that address.
    2. (On the CLI) Confirm Proxy ARP is actively responding to requests.
      show counter global | match proxy
      Confirm the flow_proxyarp_resp_sent counter is incrementing as devices send ARP requests.
    3. (On the CLI) Review the full Proxy ARP configuration on the interface.
      show running proxy-arp interface <interface-name>
      Verify the expected IP addresses, subnets, and ranges appear in the list with the correct negate settings.
    4. (Optional) (If DHCP Relay Overwrite is configured) Verify DHCP clients received the overwritten values.
      Confirm the client received the configured DHCP relay overwrite subnet mask and gateway.
    5. Verify expected traffic is passing through the firewall and matching security policy.
      Generate traffic between two devices connected through the firewall. Select MonitorLogsTraffic and confirm the traffic appears in the logs with the expected policy action.

    © 2026 Palo Alto Networks, Inc. All rights reserved.