5406zl - ARP requests are blocked by vlan-acl after firmware update - firmware bug?

[5406zl]

I'm running an 5406zl switch

after upgrading to firmware K.15.17.0007 ARP requests are blocked

steps to reproduce:

ip access-list extended "test"

    10 permit ip any any

  exit

vlan 2

    ip access-group "test" out

    exit

applying acces-list test to vlan 2 -> no arp who has requests are sent on vlan 2

( e.g. ping works, apply access-list and clear arp on switch -> ping returns: packet filtered)

Looks like a bug in K.15.17 firmware.

Can anyone confirm that behaviour?

[mwa]

Same problem at our site.

Firmware KB.15.16.0009 works without problems.

[hpnuser]

seems to be a known issue with K/KA/KB/WB.15.17.0007 (documented in release notes http://h20564.www2.hp.com/hpsc/doc/public/display?docId=c04715508): Issues and workarounds Routing CR_0000174881 The switch does not initiate an ARP request to the next hop IPv4 address for routed IPv4 traffic entering a VLAN that has an inbound Routed Access List (RACL) applied using the command vlan vid ip access-group identifier in. As a result, the IPv4 routed traffic will not reach its destination because the switch did not create an ARP entry in the switch ARP Table for the next hop IPv4 address, which is required to route the traffic. The issue may be intermittent because there could be other sources trying to reach the same next hop IPv4 address, which will result in creating an ARP entry. Due to the ARP age-out time of 20 minutes, the issue may reoccur after 20 minutes. For example, if the routed IPv4 traffic also enters the switch via a VLAN that does not have inbound RACL or if you ping it from the affected switch. Pinging from the switch to the unreachable IPv4 destination address will temporarily resolve the reachability issue; however, the issue may reoccur after the APR age-out expires or after invoking the CLI command clear arp. Example of an IPv4 inbound RACL configuration that could encounter this issue for packets routed through the switch: ip access-list extended "102" 10 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 exit ip routing ip route 0.0.0.0 0.0.0.0 192.168.0.1 vlan 10 name "VLAN10" untagged A1 ip access-group "102" in ip address 10.0.0.1 255.255.255.0 exit vlan 20 name "VLAN20" untagged A2 ip address 192.168.0.100 255.255.255.0 exit The issue impact only if there is IPv4 IN-RACL and if you use this option then is better to downgrade to K/KA/KB/WB.15.16.0009