Cisco ASA will answer for all ARP on all IPs within the defined interface subnets if proxyarp is enabled. This behavior can be disabled by executing