Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA Proxy Arp

Is it normal for traffic between hosts on the same subnet

to  be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.

thanks

Keith

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: ASA Proxy Arp

KeithN123 wrote:

Is it normal for traffic between hosts on the same subnet

to  be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.

thanks

Keith

Keith

Traffic between hosts in the same subnet should not need to go via the ASA. It is often a good idea to turn off proxy-arp when not needed but as you have found it can break nat statements. Generally speaking you need proxy-arp on the outside interface of the ASA most of the time but whether or not you need it on the other interfaces all depends on which nat translations you have setup.

Note also that the ASA might well be responding to the arp but so will/should the destination host in the same subnet.

Jon

2 REPLIES
Hall of Fame Super Blue

Re: ASA Proxy Arp

KeithN123 wrote:

Is it normal for traffic between hosts on the same subnet

to  be "Proxied" by the ASA interface ? If I turn off proxy arp it breaks the configured NAT.

thanks

Keith

Keith

Traffic between hosts in the same subnet should not need to go via the ASA. It is often a good idea to turn off proxy-arp when not needed but as you have found it can break nat statements. Generally speaking you need proxy-arp on the outside interface of the ASA most of the time but whether or not you need it on the other interfaces all depends on which nat translations you have setup.

Note also that the ASA might well be responding to the arp but so will/should the destination host in the same subnet.

Jon

New Member

Re: ASA Proxy Arp

thanks Jon

I kind of guessed it would be something like that - I would like to turn Proxy arp off on the management interface but i'm a little bit worried about disconnecting myself and not being able to fix it quickly -  this is  on a live network. I think common sense would tell me to do it out of office hours.

many thanks for the information.

regards

Keith

1715
Views
0
Helpful
2
Replies