Man in the middle in lab using Endian FW

[Guest]

[Alme]

Hello
I am trying to create a lab for my university in order to teach some security topics.
We decided to use Endian Firewall as our gateway due to its simplicity and nice Web Interface. When we try to perform a Man in the middle through arp spoofing, although the Firewall is disabled, we can not perform it when machines use the fw as gateway. When machines are not behind the FW everything works great. I wonder is there some kind of arp spoofing protection module build inside the FW which prevents it?

Thank you for you time