ASA Proxy Arp

Answered Question
Apr 26th, 2010

Is it normal for traffic between hosts on the same subnet

to  be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.

thanks

Keith

I have this problem too.
0 votes
Correct Answer by Jon Marshall about 3 years 11 months ago

KeithN123 wrote:

Is it normal for traffic between hosts on the same subnet

to  be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.

thanks

Keith

Keith

Traffic between hosts in the same subnet should not need to go via the ASA. It is often a good idea to turn off proxy-arp when not needed but as you have found it can break nat statements. Generally speaking you need proxy-arp on the outside interface of the ASA most of the time but whether or not you need it on the other interfaces all depends on which nat translations you have setup.

Note also that the ASA might well be responding to the arp but so will/should the destination host in the same subnet.

Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 5 (1 ratings)
Correct Answer
Jon Marshall Mon, 04/26/2010 - 01:18

KeithN123 wrote:

Is it normal for traffic between hosts on the same subnet

to  be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.

thanks

Keith

Keith

Traffic between hosts in the same subnet should not need to go via the ASA. It is often a good idea to turn off proxy-arp when not needed but as you have found it can break nat statements. Generally speaking you need proxy-arp on the outside interface of the ASA most of the time but whether or not you need it on the other interfaces all depends on which nat translations you have setup.

Note also that the ASA might well be responding to the arp but so will/should the destination host in the same subnet.

Jon

KeithN123 Mon, 04/26/2010 - 01:32

thanks Jon

I kind of guessed it would be something like that - I would like to turn Proxy arp off on the management interface but i'm a little bit worried about disconnecting myself and not being able to fix it quickly -  this is  on a live network. I think common sense would tell me to do it out of office hours.

many thanks for the information.

regards

Keith

Actions

Login or Register to take actions

This Discussion

Posted April 26, 2010 at 12:57 AM
Stats:
Replies:2 Avg. Rating:5
Views:1391 Votes:0
Shares:0
Tags: No tags.

Discussions Leaderboard

Rank Username Points
1 7,861
2 6,140
3 3,170
4 1,473
5 1,446