ASA trying to intra-subnet traffic

[jason.williams]

We have a firewalled segment on an ASA.  There are both wired and wireless systems on this segment.  We're having an issue where the wireless hosts cannot connect to the wired hosts.  Based on the logs, it looks like the traffic from the wireless hosts are trying to go out of the firewall, even though they are on the same IP subnet:

%ASA-4-106023: Deny udp src Skylight:10.157.22.53/64529 dst Inside:10.157.22.51/53 by access-group "Skylight_in" [0x0, 0x0]

I'm not entirely sure that this is a firewall issue, but since I'm seeing this behavior behind the ASA, I figured I'd start here.

Any thoughts?

Thanks.

Jason

[Jouni Forss]

Hi,

Not really familiar with Wireless setups.

The log seems to indicate that the traffic is coming from behind the "Skylight" interface and is heading for a network behind "Inside" interface and is getting blocked by the interface ACL.

Is the user traffic supposed to be coming from behind the "Skylight" interface or "Inside"?

- Jouni

[jason.williams]

Actually I figured it out.  proxy arp was enabled on the interface.  Once I disabled it (noproxyarp), it fixed my problem.