topic ASA arp table in Network Security

ASA arp table

ippolito — Mon, 11 Mar 2019 22:47:30 GMT

I read a number of older posts indicating that there was no ability to walk the arp table on an ASA 5510; wondering if that has changed at all?

If not I'm looking for some workarounds. Is there a syslog message that is generated when a new arp entry is added? Please don't tell me that the only way to do this is to programmatically ssh into the ASA and grab the output from a 'show arp' command!

thanks,

Mike

Re: ASA arp table

Jouni Forss — Tue, 27 Mar 2012 17:58:44 GMT

EDIT: Oh dang, that original/linked post is actually also posted by you in 2008

Hi,

I found the following thread on these very forums that would suggest what you are asking for isnt possible on the ASA

I guess for some things you really do have to use scripting to get the information out of the ASA wihtout doing it manually all the time.

Heres a link to the discussion i mentioned

https://supportforums.cisco.com/thread/224857

ASA arp table

ippolito — Tue, 27 Mar 2012 18:13:52 GMT

Funny! That was one of the posts I was referring to when I said I'd read older posts suggesting it wasn't possible, but didn't see that it was posted by me four years ago!

In any event, I'm wondering if this has been added to any of the later code bases, or if there is a known workaround?

Thanks,

Mike

Re: ASA arp table

Marvin Rhoads — Tue, 27 Mar 2012 22:09:59 GMT

Still not available even in 8.4(3).

Per this link (excerpt below), you would need .1.3.6.1.2.1.4.22.1.2

I just polled one of my ASAs and confirmed that .1.3.6.1.2.1.4.22.1.2 is NOT available. Even though RFC-1213 MIB is supported, only "objects defined under System, Interfaces and IP address table are supported."

I've attached the current complete oidlist FYI.

Q. Is there an SNMP MIB to show Address Resolution Protocol (ARP) table information? I need both the IP and MAC addresses in the same table.

A. Yes, ipNetToMediaPhysAddress = .1.3.6.1.2.1.4.22.1.2 from the MIB RFC1213-MIB.my.

ipNetToMediaPhysAddress OBJECT-TYPE

       -- FROM RFC1213-MIB, IP-MIB
       -- TEXTUAL CONVENTION PhysAddress

    SYNTAX          OCTET STRING
    MAX-ACCESS      read-write
    STATUS          Mandatory
    DESCRIPTION     "The media-dependent `physical' address."
 
::= { iso(1) org(3) dod(6) internet(1) mgmt(2) mib-2(1) ip(4)
      ipNetToMediaTable(22) ipNetToMediaEntry(1) 2 }