I will be performing NAT on the outside interface of an ASA to a web server within a DMZ. I would like to disable proxy-arp on all the interfaces that I can. I know that outside interface will need to have proxy-arp enabled because of the NAT statement. Do I need to have proxy-arp enabled on the DMZ interface as well?
The web server will only need to ARP the ASA to get the MAC address for its (default) gateway.
So, the ASA won't need to reply an ARP for any other IP addresses then its own. You can safely turn off proxy-arp on the DMZ interface. You are correct in your assumption that you need it for the outside interface.