The ASA uses proxy arp to respond to an arp request for IPs it is using for NAT but that are not assigned to any interface.
So some examples should help -
1) you are connected to the ISP on the outside interface and your are using a /28 subnet for the connection. Two of those IPs are used for the ASA outside interface and the ISP end so that leaves you with spare IPs in that subnet to use for NAT (usually static NATs).
When traffic arrives from the internet at the ISP router to one of those IPs the router will send an arp request because it has an interface with an IP from that subnet.
The ASA will respond with proxy arp and send the mac address of the outside interface so traffic is sent to it.
2) You are connected to the ISP with a /30 and you also have a /28 for use with NAT but no IPs from that range are assigned to any interfaces either on the ASA or the ISP router.
The ISP has a route on their router for the /28 pointing to your end of the /30.
Here there is no need for proxy arp because any traffic coming to those IPs will be routed to your ASA.
The above examples are the ones you see the most in my experience however there is a third example I have come across -
3) this is where you have a /30 and a /28 and the ISP uses secondary addressing on their router interface ie. the main IP is the /30 but they also allocate one of the /28s to the interface as well.
Your ASA does not use one of the /28s on the interface but the ISP will arp for any of the /28 IPs because it is a secondary IP on their interface.
For this to work you need to enable "permit arp non-connected" on your firewall.
Note a /28 was used purely as an example, it could be anything, depending on what your ISP has assigned you.
Any queries please come back.
Jon
