1

For some reason our Cisco is responding to arp requests between machines on the same switch. It's not breaking anything but it is slowing initial connections. I've been making a lot of changes on the Cisco recently to configure a client and site 2 site vpn. The most recent being disabling nat between certain ip ranges. Any ideas why this might be happening?

devperf01b:~ sudo arping devperf01c
   ARPING 10.201.9.230
   60 bytes from 2c:33:11:2e:xx:xx (10.x.9.230): index=0 
     time=214.100 usec
     60 bytes from 18:03:73:be:xx:xx (10.x.9.230): index=1 
     time=257.969 usec
  • Do you have proxy ARP enabled on the router interfaces? That is something you should disable because it is a security risk. – Ron Maupin Oct 15 '19 at 14:32
  • It doesn't look like you have disabled proxy ARP (no ip proxy-arp). – Ron Maupin Oct 15 '19 at 14:45
  • It's a double negative so I think this means proxyarp is enabled on the inside interface:- no sysopt noproxyarp inside however there are still some machines on this internal network that are natted and apparently disabling proxy arp will break that. So I probably need to try this change out out of hours. Possibly of interest is that I've been adding nat rules like this for the vpn:- nat (inside,any) source static obj-10.1xx.200.0 obj-10.1xx.200.0 destination static obj-10.2xx.0.0 obj-10.2xx.0.0 no-proxy-arp route-lookup – user62679 Oct 15 '19 at 14:53
  • You should not use NAT unless it is absolutely required. That would only be for public<->private addressing and overlapping addressing, but if you have overlapping addressing, then you need to correct that situation. NAT is not a substitute for routing. – Ron Maupin Oct 15 '19 at 14:56
  • Proxy ARP means different things to the ASA (and PIX) Just turning it off can make a lot of things stop working - almost at random. The crap that is "new-nat" removed all the nat0 stuff, so it's a mess to selectively nat traffic. – Ricky Beam Oct 15 '19 at 18:51
0

I found the cause, I'd added a nat disabling line that didn't include no-proxy-arp:-

nat (outside,any) source static DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3 destination static AWS_ALL AWS_ALL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.