topic ASA 5520 and interface proxy arp setting in Network Security

ASA 5520 and interface proxy arp setting

sham — Mon, 11 Mar 2019 11:41:01 GMT

What are the porpose of proxy arps setting, and how should be be setup?

Re: ASA 5520 and interface proxy arp setting

Jon Marshall — Sat, 08 Dec 2007 19:13:44 GMT

Proxy-arp allows the ASA device to respond to an ARP for hosts that are behind it. So if you have a static mapping eg.

static (inside,outside) 195.167.10.1 192.168.5.1 netmask 255.255.255.255

when a machines on the outside of the ASA arps for 195.167.10.1 the ASA replies with the MAC address of it's outside interface and then forwards the packet on to the internal address of 192.168.5.1.

Attached is a troubleshooting doc for ASA/Pix connectivity issues. Have a look at number 11 in the list which explains proxy-arp in a bit more detail.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008009402f.shtml#trouble

HTH

Jon

Re: ASA 5520 and interface proxy arp setting

sham — Sat, 08 Dec 2007 19:29:29 GMT

Thankx for your reply, It looks like we have to enable ouside interface's proxy arps, but do we have to enable proxy arps for inside and dzm interfaces?

Re: ASA 5520 and interface proxy arp setting

Jon Marshall — Sat, 08 Dec 2007 19:42:59 GMT

It depends on your static mappings ie. if you map things between the DMZ and the inside you would need it on the DMZ interface.

As for the inside, again it depends on whether you are wanting to present outside destinations as different addresses to your inside clients.

Jon