FortiGate get system arp

Overview

get system arp displays IPv4 ARP entries learned by the FortiGate.

ARP maps IPv4 addresses to MAC addresses on directly connected Layer 2 networks. The table is useful when validating whether the FortiGate has recently communicated with a local device and on which interface that neighbor was learned.

Command

get system arp

Typical output

Address         Age(min)  Hardware Addr       Interface
10.1.10.20      0         00:11:22:33:44:55   VLAN10
10.1.50.10      2         aa:bb:cc:dd:ee:ff   VLAN50

Fields

Address

The IPv4 address associated with the ARP entry.

Age

The age of the learned entry, shown in minutes in the standard table output.

Hardware Addr

The MAC address associated with the IPv4 neighbor.

Interface

The FortiGate interface on which the neighbor is reachable.

When to use it

Use get system arp when:

• A directly connected host cannot be reached.
• You need to confirm which MAC address owns an IP address.
• You suspect an IP conflict.
• You need to verify the interface on which a local endpoint is learned.
• A firewall policy is correct but local delivery still fails.
• You are checking whether a device has recently communicated with the FortiGate.

How to interpret the result

Expected IP and MAC are present

This proves the FortiGate currently has an ARP mapping for that local IPv4 address.

It does not prove that the endpoint application is reachable or that a firewall policy permits all relevant traffic.

IP is present with an unexpected MAC

Possible causes include:

• Duplicate IP address
• Device replacement
• Stale ARP information
• Virtual IP ownership changes
• HA or virtualization behaviour

Confirm the MAC address against the endpoint, switch CAM/MAC table, DHCP lease, or inventory.

IP is absent

Possible explanations include:

• No recent Layer 3 communication with the host
• Host offline
• Wrong VLAN
• Wrong subnet mask
• Layer 2 path failure
• The destination is not actually directly connected

Generate traffic, for example with a ping from the FortiGate, then inspect the table again.

Detailed ARP cache

For more detailed ARP information, Fortinet also documents:

diagnose ip arp list

This can expose additional internal state not shown by the simpler get system arp output.

Validation workflow

For a local host such as 10.1.10.20:

1. Confirm the FortiGate interface belongs to the same subnet.
2. Run:

get system arp

3. Check whether 10.1.10.20 is present.
4. Compare the MAC with the expected endpoint.
5. If absent, generate traffic:

execute ping 10.1.10.20

6. Inspect ARP again.
7. If still absent, troubleshoot Layer 2/VLAN connectivity.

Risks and considerations

This command is read-only and has no direct operational impact.

The main limitation is scope: ARP applies only to directly reachable IPv4 neighbors. You should not expect the FortiGate to have an ARP entry for a host several routed hops away.

Related articles

• FortiGate execute ping
• FortiGate packet sniffer
• FortiGate routing table

Sources

See the authoritative Fortinet reference in the article metadata.