https://community.cisco.com/t5/network-security/secondary-wan-ip-proxy-arp-problem/m-p/5122674#M1113238 <P>I have Cisco Firepower with FMC and 3 ISP public IP in one subnet /24. First IP is in firewalls interface, second IP in dedicated PC, third IP I want to 1 to 1 NAT to my DMZ network IP from firewall, but ISP has IP-MAC binding and he can't see my arp respond from my third IP, I think it is because Firepower answers to ARP respond with his own MAC adress for the first and third IP and ISP have some one&nbsp;mac to one ip policy. Can we change MAC address for third IP responds? I tried to add ARP response on interface for IP MAC but it haven't help.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="111.png" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/219841i8EE01639C59CCB3B/image-size/medium?v=v2&amp;px=400" role="button" title="111.png" alt="111.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>In screenshot you can see that firewalls and third IP mac are same from arp table of second dedicated PC&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="222.png" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/219842i1C5CB2A76BEE653B/image-size/medium?v=v2&amp;px=400" role="button" title="222.png" alt="222.png" /></span></P> Sat, 01 Jun 2024 18:47:28 GMT sherali mamatkarimov 2024-06-01T18:47:28Z https://community.cisco.com/t5/network-security/secondary-wan-ip-proxy-arp-problem/m-p/5122674#M1113238 <P>I have Cisco Firepower with FMC and 3 ISP public IP in one subnet /24. First IP is in firewalls interface, second IP in dedicated PC, third IP I want to 1 to 1 NAT to my DMZ network IP from firewall, but ISP has IP-MAC binding and he can't see my arp respond from my third IP, I think it is because Firepower answers to ARP respond with his own MAC adress for the first and third IP and ISP have some one&nbsp;mac to one ip policy. Can we change MAC address for third IP responds? I tried to add ARP response on interface for IP MAC but it haven't help.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="111.png" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/219841i8EE01639C59CCB3B/image-size/medium?v=v2&amp;px=400" role="button" title="111.png" alt="111.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>In screenshot you can see that firewalls and third IP mac are same from arp table of second dedicated PC&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="222.png" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/219842i1C5CB2A76BEE653B/image-size/medium?v=v2&amp;px=400" role="button" title="222.png" alt="222.png" /></span></P> Sat, 01 Jun 2024 18:47:28 GMT https://community.cisco.com/t5/network-security/secondary-wan-ip-proxy-arp-problem/m-p/5122674#M1113238 sherali mamatkarimov 2024-06-01T18:47:28Z https://community.cisco.com/t5/network-security/secondary-wan-ip-proxy-arp-problem/m-p/5122680#M1113239 <P>The problem was that ISP requesting ARP from different subnet and Cisco doesn't answering to different subnet, solution is to create flexconfig object "<SPAN>arp permit-nonconnected"</SPAN></P> Sat, 01 Jun 2024 19:26:15 GMT https://community.cisco.com/t5/network-security/secondary-wan-ip-proxy-arp-problem/m-p/5122680#M1113239 sherali mamatkarimov 2024-06-01T19:26:15Z