Doubts about how the ARP tables of the ASA/Firepower may behave

[Ariel_DF]

Hello,

We have doubts about how the ARP tables of the ASA/Firepower may behave. I explain the situation we have, I have attached an image with the topology we have right now.

The objective is to remove the IPS (which are in transparent mode inspecting traffic only) and allow the direct connection of the Routers to the firewalls (the connection is through switches), reusing the same IPs and VLANs, so the configuration change would only be in the Routers.

Right now in the ARP table of the ASA/Firepower (and all contexts) the IP 192.168.70.1 has a MAC XX:XX:XX and when the IPS are removed this same IP 192.168.70.1 will have another MAC YY:YY: YY.

In this case would it be necessary to clear ARP in the firewalls? Or when the router sends the Gratuitous ARP because we are configuring a new interface, do the firewalls instantly update the ARP tables?

Thanks.

[Marius Gunnerud]

Is this ASA or FTD software?

The behaviour will depend a on if you have ARP inspection configured on the firewall or not.  If it is not configured then the ARP table should be updated automatically when the router sends a gratuitous ARP.  If ARP inspection is enabled then you will need to clear the ARP table.

[Ariel_DF]

Thanks for the help!!