This was an interesting evening. I went onsite to a customer and put in one of those TZ600 SonicWall firewalls I just configured. Once I got it in place, I noticed the normal ARP issue that you have on the next hop router. So I rebooted the ISP router. As it turns out, there is a firmware issue on these Cisco ASR920 routers that when you reboot the system, if you have fiber modules in the ASR, it can cause an issue forwarding traffic, even though the interfaces are up. The fix? Literally, pull out the Gbic modules and re-seat them. All OK after that.