<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Proxy ARP is disabled on software version 8.4.5 and above by default.<div><br></div><div><br></div><div>arp permit-nonconnected</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>Cheers,</div><div>Josh</div><div><br><br><div><hr id="stopSpelling">Date: Thu, 3 Apr 2014 15:09:24 +1000<br>From: colin.stubbs@equatetechnologies.com.au<br>To: Alex.Samad@yieldbroker.com<br>CC: ausnog@lists.ausnog.net<br>Subject: Re: [AusNOG] Cisco ASA question<br><br><div dir="ltr"><br><div>Ugh. I figured you'd have that kind of topology.</div><div><br></div><div>You'll need to use proxy ARP in conjunction with the OSPF route to <a href="http://1.2.3.129/32" target="_blank" rel="noreferrer">1.2.3.129/32</a>.</div>
<div><br></div>
<div>I believe even in the latest 9.x releases that's still enabled by default on ASA's so it'll probably happen without you even realising it. Make sure you understand how proxy ARP works.</div><div><br></div>
<div>Do NAT exemption for <a href="http://1.2.3.129/32" target="_blank">1.2.3.129/32</a> and any other public IP's you push further into the network and that should work.</div><div><br></div><div>As mentioned in the other email, while using loopbacks for routing protocols is certainly best practice, you don't need to use a public address on them.</div>
<div><br></div><div>I'd only be doing that in your topology if R0 is not a device you control and BGP must be utilised between R0 and R2.</div><div><br></div><div>Otherwise, in my opinion, all you're doing by putting a public IP on there is making it easier to accidentally expose the router to the Internet when it doesn't need to be.</div>
<div><br></div><div>-Colin</div><div class="ecxgmail_extra">
<br><br><div class="ecxgmail_quote">On 3 April 2014 14:57, Alex Samad - Yieldbroker <span dir="ltr"><<a href="mailto:Alex.Samad@yieldbroker.com" target="_blank">Alex.Samad@yieldbroker.com</a>></span> wrote:<br><blockquote class="ecxgmail_quote" style="border-left:1px #ccc solid;padding-left:1ex;">
++<br>
|R0| <a href="http://1.2.3.254/24" target="_blank">1.2.3.254/24</a><br>
++<br>
<br>
<a href="http://1.2.3.0/24" target="_blank">1.2.3.0/24</a> Public<br>
<br>
+-------------------+ object nat for<br>
.1 & .2 .10,.11,.12,.13,.14<br>
++ etc<br>
|R1|<br>
++<br>
<br>
+---------------+<br>
<a href="http://10.0.0.0/24" target="_blank">10.0.0.0/24</a><br>
<br>
<br>
<br>
+-----------------+<br>
<br>
++ <a href="http://1.2.3.129/32" target="_blank">1.2.3.129/32</a><br>
|R2| on loopback<br>
++<br>
<br>
<br>
<a href="http://1.2.3.0/24" target="_blank">1.2.3.0/24</a> - is a public routable network<br>
R0 is a router on <a href="http://1.2.3.0/24" target="_blank">1.2.3.0/24</a> network<br>
R1 is the ASA int internet is on network <a href="http://1.2.3.0/24" target="_blank">1.2.3.0/24</a> has .1 & .2 assign to it (asa cluster), it also has the DGW via 1.2.3.254<br>
R2 is a router inside my network and advertises <a href="http://1.2.3.129/32" target="_blank">1.2.3.129/32</a> via OSPF, which R1 picks up on interface internal<br>
<br>
<a href="http://10.0.0.0/24" target="_blank">10.0.0.0/24</a> is used on the internal R1 interface<br>
<br>
so if R0 tries to send a packet to 1.2.3.129 will the ASA (R1) reply to arp requests and will it then route it internally if I use identity nat or the nat exemption some people have suggest<br>
<br>
Thanks to Eric for the link to asci draw. I think though that outlook kills it :(<br>
<span class="ecxHOEnZb"><font color="#888888"><br>
A<br>
</font></span><div class="ecxHOEnZb"><div class="h5"><br>
<br>
<br>
<br>
<br>
> -----Original Message-----<br>
> From: Alex Samad - Yieldbroker<br>
> Sent: Thursday, 3 April 2014 2:26 PM<br>
> To: <a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a><br>
> Subject: Cisco ASA question<br>
><br>
> Hi<br>
><br>
> I have a Cisco ASA question for the list.<br>
><br>
> I have a 5520 (cluster)<br>
><br>
> int Internet<br>
> int internal<br>
><br>
> on the internet I have my dGW to the internet, I also have my own class c,<br>
> lets say <a href="http://1.2.3.0/24" target="_blank">1.2.3.0/24</a><br>
><br>
> I have a few object nat's defined for 1.2.3.x/24<br>
><br>
> I am going to start moving the NAT function away from the ASA.<br>
><br>
> I have a router inside my network with <a href="http://1.2.3.129/32" target="_blank">1.2.3.129/32</a> on a look back interface<br>
> and its advertised internally via OSPF. It can be seen on the ASA<br>
><br>
> From my reading I believe I can get the ASA to forward and not nat for .129 if<br>
> I use Identity NAT<br>
><br>
> But I can't find any examples for mixed Object NAT and identity NAT And I<br>
> am not sure the identity NAT will respond to ARP on the internet interface<br>
> And I presume I have to add the right permit.<br>
><br>
> I asked at the cisco forums, but the only person to respond said I couldn't do<br>
> the /32 trick ...<br>
><br>
> So I am come to the list<br>
><br>
> Thanks in advance<br>
><br>
> Alex<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</div></div></blockquote></div><br></div></div>
<br>_______________________________________________
AusNOG mailing list
AusNOG@lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog</div></div> </div></body>
</html>