Enabling Arp Inspection - Cisco ASA 5505 Configuration Manual

Configuring ARP Inspection for the Transparent Firewall
The transparent firewall uses dynamic ARP entries in the ARP table for traffic to and from the adaptive
Note
security appliance, such as management traffic.
Detailed Steps
Step 1 Choose the Configuration > Device Setup > ARP > ARP Static Table pane.
Step 2 (Optional) To set the ARP timeout for dynamic ARP entries, enter a value in the ARP Timeout field.
This field sets the amount of time before the adaptive security appliance rebuilds the ARP table, between
60 to 4294967 seconds. The default is 14400 seconds. Rebuilding the ARP table automatically updates
new host information and removes old host information. You might want to reduce the timeout because
the host information changes frequently.
Click Add.
Step 3
The Add ARP Static Configuration dialog box appears.
From the Interface drop-down list, choose the interface attached to the host network.
Step 4
In the IP Address field, enter the IP address of the host.
Step 5
Step 6 In the MAC Address field, enter the MAC address of the host; for example, 00e0.1e4e.3d8b.
Step 7 To perform proxy ARP for this address, check the Proxy ARP check box.
If the adaptive security appliance receives an ARP request for the specified IP address, then it responds
with the specified MAC address.
Step 8 Click OK, and then Apply.
What to Do Next
Enable ARP inspection according to the

Enabling ARP Inspection

This section describes how to enable ARP inspection.
Detailed Steps
Choose the Configuration > Device Setup > ARP > ARP Inspection pane.
Step 1
Choose the interface row on which you want to enable ARP inspection, and click Edit.
Step 2
The Edit ARP Inspection dialog box appears.
Step 3 To enable ARP inspection, check the Enable ARP Inspection check box.
Step 4 (Optional) To flood non-matching ARP packets, check the Flood ARP Packets check box.
By default, packets that do not match any element of a static ARP entry are flooded out all interfaces
except the originating interface. If there is a mismatch between the MAC address, the IP address, or the
interface, then the adaptive security appliance drops the packet.
If you uncheck this check box, all non-matching packets are dropped, which restricts ARP through the
adaptive security appliance to only static entries.
Cisco ASA 5500 Series Configuration Guide using ASDM
5-10
Chapter 5 Configuring the Transparent or Routed Firewall
"Enabling ARP Inspection" section on page 5-10.
OL-20339-01