Solved: ASA Proxy Arp

KeithN123 · ‎04-26-2010

Is it normal for traffic between hosts on the same subnet

to be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.

thanks

Keith

Jon Marshall · ‎04-26-2010

KeithN123 wrote:

Is it normal for traffic between hosts on the same subnet

to be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.

thanks

Keith

Traffic between hosts in the same subnet should not need to go via the ASA. It is often a good idea to turn off proxy-arp when not needed but as you have found it can break nat statements. Generally speaking you need proxy-arp on the outside interface of the ASA most of the time but whether or not you need it on the other interfaces all depends on which nat translations you have setup.

Note also that the ASA might well be responding to the arp but so will/should the destination host in the same subnet.

Jon

View solution in original post

Jon Marshall · ‎04-26-2010

KeithN123 wrote:

Is it normal for traffic between hosts on the same subnet

to be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.

thanks

Keith

Traffic between hosts in the same subnet should not need to go via the ASA. It is often a good idea to turn off proxy-arp when not needed but as you have found it can break nat statements. Generally speaking you need proxy-arp on the outside interface of the ASA most of the time but whether or not you need it on the other interfaces all depends on which nat translations you have setup.

Note also that the ASA might well be responding to the arp but so will/should the destination host in the same subnet.

Jon

KeithN123 · ‎04-26-2010

thanks Jon

I kind of guessed it would be something like that - I would like to turn Proxy arp off on the management interface but i'm a little bit worried about disconnecting myself and not being able to fix it quickly - this is on a live network. I think common sense would tell me to do it out of office hours.

many thanks for the information.

regards

Keith