Enable Proxy ARP on a Layer 3 interface so the firewall intercepts ARP requests and
redirects intra-VLAN traffic for security inspection and policy enforcement.
| Where Can I Use This? | What Do I Need? |
|---|
Once Proxy ARP is enabled on an interface, the firewall intercepts ARP
requests for all addresses within the interface's subnet by default and replies with
its own MAC address. The requesting device then sends its traffic to the firewall
instead of directly to the destination device, enabling the firewall to apply
security policy, including App-ID™, User-ID™, and Device-ID inspection, before
forwarding the traffic.
Apart from interface subnets, you can configure additional address entries
for Proxy ARP. You can configure negate entries to exclude specific addresses from
Proxy ARP. When a device sends an ARP request for a negated address, the firewall
does not respond, allowing that traffic to bypass Proxy ARP.
You can configure up to 500 Proxy ARP address entries per interface.
Individual IP addresses and subnets each count as one entry. IP address ranges are
expanded into CIDR prefixes, and each resulting prefix counts as one entry. The
overall number of devices the firewall can proxy ARP for is also bounded by the
firewall's ARP table limit; when the table is full, new ARP entries cannot be
created and devices may lose the ability to reach each other through the firewall.
When you configure both a range and a specific address within that range with
different negate settings, configure the more specific entry (such as a /32 single
address) before the broader range entry. The firewall uses longest-prefix match to
select the applicable entry, so a more specific entry takes priority.
Hosts cache ARP entries until a timer expires. If a host is added to the negate list
on the firewall, the device can still continue to send traffic until its cached ARP
entry expires. When you add a negate entry to an existing Proxy ARP configuration,
devices that already have the firewall's MAC address cached for that address
continue to send traffic to the firewall until their ARP cache expires. The negate
entry takes effect only for new ARP requests.
After enabling the feature, confirm it is active by running show counter
global | match proxy and verifying the
flow_proxyarp_resp_sent counter is incrementing.
