topic Re: ASA' proxy-arp doesnt work in Network Security

ASA' proxy-arp doesnt work

Andrii Oliinyk — Wed, 14 Jul 2021 09:13:17 GMT

I have multisubnet setup where clients behind one of the interfaces fail to configure default gateway properly. to speedup process i've configured NAT-rule (1st in chain)

nat (VLAN.803,any) source static VLAN803 VLAN803 destination static BMUVLANS BMUVLANS route-lookup

with it i expected ASA to start to respond ARP-queries from clients in VLAN 803 with its own VLAN.803 MAC, but it doesnt do.

i've verified it with capture. what can prevent ASA from ARP-proxying in this case?

Re: ASA' proxy-arp doesnt work

Marvin Rhoads — Wed, 14 Jul 2021 12:29:12 GMT

Check the output from "show run all | i proxyarp".

Re: ASA' proxy-arp doesnt work

Andrii Oliinyk — Wed, 14 Jul 2021 12:34:37 GMT

Hi Marvin

highly appreciate your input, it looks like this for target VLAN

no sysopt noproxyarp VLAN.803 . negating of negating

Re: ASA' proxy-arp doesnt work

Marvin Rhoads — Wed, 14 Jul 2021 17:12:53 GMT

Hmm so the double negative means the interface should proxy-arp as needed. The NAT rule doesn't specify the "no proxy-arp" option so that shouldn't affect it either.