Details
Disables the Proxy-ARP function on untrusted interfaces
Rationale:
The ASA replies to ARP requests performed to IP addresses belonging to its interfaces’ subnets and also to global IP addresses in some NAT configurations. Where the appliance is not asked to be a proxy for ARP requests, the Proxy-ARP function should be disabled especially on untrusted interfaces since attackers can act as legitimate devices by spoofing their IP addresses, perform ARP requests thus receiving packets intended to them.
Solution
* Step 1: Acquire the name of the untrusted interface
* Step 2: Run the following command to disable the Proxy-ARP on the untrusted interface.
HOSTNAME(CONFIG)# SYSOPT NOPROXYARP _
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Cisco.