The Proxy ARP micro-segmentation approach leverages port isolation features on the switch to direct intra VLAN traffic between the hosts to the firewall. For any device to communicate with another device in the same VLAN, an ARP request is sent out for the target device IP. With port isolation support, firewall connected to the managed switch intercepts the ARP requests if Proxy ARP is enabled on that interface and responds with its own MAC address effectively acting as a ARP proxy. All subsequent communication between the devices is redirected through the NGFW, allowing NGFW to perform Layer 7 visibility and policy enforcement.

This method does not require a change in IP address, making it suitable for existing deployments that cannot accommodate IP address changes.

For intra-VLAN microsegmentation, configure the overwrite subnet mask as 255.255.255.255 (/32) and the overwrite gateway as the IP address of the firewall's interface. Each client receives a /32 host mask, which means the client treats every other address, including addresses of devices on the same VLAN, as outside its local network. The client routes all traffic to the default gateway, which is the firewall, giving the firewall full visibility and policy enforcement over every packet the client sends from the moment it connects.

DHCP Relay Overwrite complements Proxy ARP in a microsegmentation deployment. Proxy ARP handles traffic from devices that already have static IP addresses by intercepting their ARP requests; DHCP Relay Overwrite handles devices that obtain addresses dynamically, ensuring those devices route through the firewall without requiring any reconfiguration on the device itself.