Skip to main content
Network Engineering

Return to Revisions

2 of 2
edited body
paperangel220
paperangel220
  • 103
  • 4

arp permit-nonconnected Not Working

I have a ASA 5506-X version 9.8(2). The ASA has two interfaces: g1/1 (outside, ip: 209.165.0.2/30), and g1/3 (inside, ip: 209.165.0.5/30).

g1/1 is connected to a 881-W router (Router-A), whose ip is 209.165.0.1/30. Router-A's internal interface is 192.168.0.1/24.

g1/3 is connected to a 2821 router (Router-B), whose ip is 209.165.0.6/30. Router-B's internal interface is 10.0.0.1/24.

This is what the topology looks like: (Note that I have an actual physical lab, I just diagrammed it in Packet Tracer so that it's easier to visualize. Also the model numbers on the Packet Tracer diagram do not correspond with the actual physical models)

enter image description here


Below are my additional configurations:

881-W's routes:

ip route 209.165.0.4 255.255.255.252 vlan 2 <------------ (I would like to test if a directly connected route can result in a successful ping. If I change this to a next hop route (ip route 209.165.0.4 255.255.255.252 209.165.0.2), ping is successful. But as of now, ping is unsuccessful if I use the directly connected route.)

ip route 10.0.0.0 255.255.255.0 209.165.0.2


2821's routes:

ip route 192.168.0.0 255.255.255.0 209.165.0.5

ip route 209.165.0.0 255.255.255.252 209.165.0.5


ASA's routes and ACL:

route outside 192.168.0.0 255.255.255.0 209.165.0.1

route inside 10.0.0.0 255.255.255.0 209.165.0.6

access-list PERMIT extended permit ip any any

access-group PERMIT in interface outside

access-group PERMIT in interface inside

access-group PERMIT out interface outside

access-group PERMIT out interface inside


I added arp permit-nonconnected on the ASA, but pinging from 192.168.0.1 to 10.0.0.1 does not work. Why?


debug arp on ASA outputs:

arp-in: request at outside from 209.165.0.1 588d.09a4.f3cc for 10.0.0.1 0000.0000.0000 having smac 588d.09a4.f3cc dmac ffff.ffff.ffff arp-set: added arp outside 209.165.0.1 588d.09a4.f3cc and updating NPs at 19:52:01.599


Shouldn't it work even if the source (209.165.0.1) and destination address (10.0.0.1) of the ARP packet are in different subnets, since I configured arp permit-nonconnected?

Thanks for the help!

paperangel220
  • 103
  • 4