topic Re: NAT and ARP in Network Security https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743718#M979477 <HTML><HEAD></HEAD><BODY><P>You may use following command-</P><P></P><P>sysopt noproxyarp <INTERFACE_NAME></INTERFACE_NAME></P><P></P><P>Note: Using above command affets all the translations on <INTERFACE_NAME>, as PIX will stop proxy-arping for all those addresses. PIX will only ARP for IP address on its interface only, once above command is implemented.</INTERFACE_NAME></P><P></P><P>Hope this helps.</P><P></P><P>Regards,</P><P>Vibhor.</P></BODY></HTML> Thu, 07 Jun 2007 00:55:10 GMT vitripat 2007-06-07T00:55:10Z NAT and ARP https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743715#M979474 <P>Is it possible to configure a static NAT for which PIX will not reply any arp request?</P><P></P> Mon, 11 Mar 2019 10:24:41 GMT https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743715#M979474 rsik 2019-03-11T10:24:41Z Re: NAT and ARP https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743716#M979475 <HTML><HEAD></HEAD><BODY><P>Can you route to it?</P></BODY></HTML> Wed, 06 Jun 2007 09:02:48 GMT https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743716#M979475 froggy3132000 2007-06-06T09:02:48Z Re: NAT and ARP https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743717#M979476 <HTML><HEAD></HEAD><BODY><P>Yes, I believe routing is not an issue in terms of my configuration. </P><P></P><P>I have a load balancer device in front of PIX to load balance some services on the servers protected by PIX. I have static NATs for the real IP addresses of the servers. Yet, I need to configure VIP addresses to be handled by PIX. However, according to the load balancer documentation, nobody should reply the arp request for VIP, except itself. So, they were suggesting to set loopback addresses on the server for VIPs. However, when I put PIX in between them, things get complicated. And I need to handle the issue properly with PIX.</P></BODY></HTML> Wed, 06 Jun 2007 14:28:15 GMT https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743717#M979476 rsik 2007-06-06T14:28:15Z Re: NAT and ARP https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743718#M979477 <HTML><HEAD></HEAD><BODY><P>You may use following command-</P><P></P><P>sysopt noproxyarp <INTERFACE_NAME></INTERFACE_NAME></P><P></P><P>Note: Using above command affets all the translations on <INTERFACE_NAME>, as PIX will stop proxy-arping for all those addresses. PIX will only ARP for IP address on its interface only, once above command is implemented.</INTERFACE_NAME></P><P></P><P>Hope this helps.</P><P></P><P>Regards,</P><P>Vibhor.</P></BODY></HTML> Thu, 07 Jun 2007 00:55:10 GMT https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743718#M979477 vitripat 2007-06-07T00:55:10Z Re: NAT and ARP https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743719#M979478 <HTML><HEAD></HEAD><BODY><P>Thanks for the suggestion, but my understanding from your explanation above is that it would stop arp replies for all static NATs defined for that interface. This is not what I want. What I want is to have proxy arp for some NATs (for the real IPs), while no proxy arp for other NATs (for the virtual IPs). To be more specific, real IPs are the ones assigned to the physical interfaces of a server. Virtual IPs are the ones assigned to loopback interfaces of a server. In a normal operation, servers only reply to arp request for the real IPs, but no arp replies for virtual IPs. Therefore, when I put a PIX device in front of such a configured server, I would like to have the same type of behaviour after NATs.</P><P></P><P>Anyways, may be I am forcing too much, and is not a realistic implementation. But if you have any other idea, please send them.</P><P></P><P>Thanks!</P></BODY></HTML> Thu, 07 Jun 2007 14:41:08 GMT https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743719#M979478 rsik 2007-06-07T14:41:08Z Re: NAT and ARP https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743720#M979479 <HTML><HEAD></HEAD><BODY><P>Unfortunately, we cant selectively disable proxy-arp for some IPs.</P><P></P><P>Regards,</P><P>Vibhor.</P></BODY></HTML> Thu, 07 Jun 2007 16:58:51 GMT https://community.cisco.com/t5/network-security/nat-and-arp/m-p/743720#M979479 vitripat 2007-06-07T16:58:51Z