ASA Proxy Arp

Answered Question
Apr 26th, 2010
User Badges:

Is it normal for traffic between hosts on the same subnet

to  be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.


thanks


Keith

Correct Answer by Jon Marshall about 7 years 3 months ago

KeithN123 wrote:


Is it normal for traffic between hosts on the same subnet

to  be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.


thanks


Keith


Keith


Traffic between hosts in the same subnet should not need to go via the ASA. It is often a good idea to turn off proxy-arp when not needed but as you have found it can break nat statements. Generally speaking you need proxy-arp on the outside interface of the ASA most of the time but whether or not you need it on the other interfaces all depends on which nat translations you have setup.


Note also that the ASA might well be responding to the arp but so will/should the destination host in the same subnet.


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jon Marshall Mon, 04/26/2010 - 01:18
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

KeithN123 wrote:


Is it normal for traffic between hosts on the same subnet

to  be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.


thanks


Keith


Keith


Traffic between hosts in the same subnet should not need to go via the ASA. It is often a good idea to turn off proxy-arp when not needed but as you have found it can break nat statements. Generally speaking you need proxy-arp on the outside interface of the ASA most of the time but whether or not you need it on the other interfaces all depends on which nat translations you have setup.


Note also that the ASA might well be responding to the arp but so will/should the destination host in the same subnet.


Jon

KeithN123 Mon, 04/26/2010 - 01:32
User Badges:

thanks Jon



I kind of guessed it would be something like that - I would like to turn Proxy arp off on the management interface but i'm a little bit worried about disconnecting myself and not being able to fix it quickly -  this is  on a live network. I think common sense would tell me to do it out of office hours.



many thanks for the information.


regards


Keith

Actions

This Discussion