-1

This is the exact line I want to edit

nat (inside,outside) source static thatplace thatplace destination static thisplace thisplace no-proxy-arp route-lookup

All I want to do is enable proxy-arp. How can I do that?

  • 3
    "All I want to do is enable proxy arp." No, you do not want to enable proxy ARP. That is a security hole, and you should not do that. Properly configured routing will not require proxy ARP. – Ron Maupin Jan 27 '18 at 16:00
0

Ignoring whether the desired proxy-arp change is appropriate for the environment (nods to @ron-maupin), the way to accomplish the stated objective from ASA CLI is to "no out" the command, then re-enter with the option removed.

no nat (inside,outside) source static thatplace thatplace destination static thisplace thisplace no-proxy-arp route-lookup
nat (inside,outside) source static thatplace thatplace destination static thisplace thisplace route-lookup

The CLI parameter is no-proxy-arp. There is not a proxy-arp parameter. Absence of the no-proxy-arp parameter enables proxy-arp on the NAT rule.

After making nat changes the ASA's xlate table (show xlate) will keep previous xlate entries in the xlate table in place until the associated conn ends (at which point the xlate timeout kicks in. clear xlate will forcefully clear the xlate table (clear xlate is intrusive, only perform during maintenance window).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.