QuestionQ26

Management and Troubleshooting

A network administrator is deploying a new Cisco Secure Firewall Threat Defense (FTD) firewall. After deploying Cisco Secure FTD, inside clients experience intermittent connectivity with one another. While reviewing a packet capture on the Secure FTD firewall, the administrator observes that Secure FTD responds to every ARP request on the inside network. Which action must the network administrator take to resolve the issue?

  • A Review the access policy and verify that ARP is allowed from inside to inside.
  • B Review NAT policy and disable incorrect proxy ARP configuration.
  • C Convert the FTD to transparent mode to allow ARP requests.
  • D Hardcode the MAC address of the FTD to IP mapping on client machines.
Explanation

An incorrect or overly broad static/identity NAT rule can cause Cisco Secure FTD to use proxy ARP for addresses on the directly connected inside network. If the firewall answers an ARP request before the actual host, clients send peer traffic to the firewall instead, causing intermittent connectivity. Correcting the NAT rule and disabling its inappropriate proxy ARP behavior resolves the problem.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!