Summary:
Proxy ARP is enabled by default on all ASA/Firepower interfaces, but it generally comes into effect only when NAT is configured. Under normal circumstances, when traffic flows between a source and destination located behind the same FTD interface, the firewall does not intercept the traffic.
However, if NAT is configured and Proxy ARP remains enabled on the interface, the FTD respond to ARP requests on behalf of a server. This behavior becomes relevant if the server goes down—because in that case, the FTD will still reply to ARP requests for the server’s IP address, potentially leading to blackholing.
Behaviour of Cisco FTD:
- You have two servers (Server A and Server B) sitting behind the same interface of a Cisco FTD (Firepower Threat Defense).
- Server B tries to reach Server A.
- When Server A goes offline, instead of ARP requests for Server A failing (as would normally happen when the host is down), the FTD itself starts replying to ARP requests on behalf of Server A.
Analysis
- Cisco TAC confirmed that this is “expected behavior / working as designed”. Suggested to disable the Proxy ARP on the interface to fix the problem.
Reference:
How to disable Proxy ARP: https://youtu.be/81GPYEoy8Ek?si=rS1t48edFmw48or5
