Configuring ARP· 1

Overview·· 1

ARP message format 1

ARP operating mechanism·· 1

ARP table· 2

Configuring a static ARP entry· 3

Configuring a multiport ARP entry· 4

Configuring the maximum number of dynamic ARP entries 5

Setting the aging timer for dynamic ARP entries 5

Enabling dynamic ARP entry check· 5

Displaying and maintaining ARP· 6

Static ARP configuration example· 6

Network requirements 7

Configuration procedure· 7

Multiport ARP entry configuration example· 8

Network requirements 8

Configuration procedure· 8

Configuring gratuitous ARP· 10

Overview·· 10

Gratuitous ARP packet learning· 10

Periodic sending of gratuitous ARP packets 10

Configuration procedure· 11

Configuring proxy ARP· 13

Enabling common proxy ARP· 13

Enabling local proxy ARP· 13

Displaying proxy ARP· 13

Common proxy ARP configuration example· 14

Network requirements 14

Configuration procedure· 14

Configuring ARP snooping· 16

Configuration procedure· 16

Displaying and maintaining ARP snooping· 16

 

The device operates in IRF or standalone (the default) mode. For information about IRF mode, see IRF Configuration Guide.

This chapter describes how to configure the Address Resolution Protocol (ARP).

Overview

ARP resolves IP addresses into MAC addresses on Ethernet networks.

ARP message format

ARP uses two types of messages: ARP request and ARP reply. Figure 1 shows the format of ARP request/reply messages. Numbers in the figure refer to field lengths.

Figure 1 ARP message format

 

·           Hardware type—Hardware address type. The value 1 represents Ethernet.

·           Protocol type—Type of the protocol address to be mapped. The hexadecimal value 0x0800 represents IP.

·           Hardware address length and protocol address length—Length, in bytes, of a hardware address and a protocol address. For an Ethernet address, the value of the hardware address length field is 6. For an IPv4 address, the value of the protocol address length field is 4.

·           OP—Operation code, which describes the type of ARP message. Value 1 represents an ARP request, and value 2 represents an ARP reply.

·           Sender hardware address—Hardware address of the device sending the message.

·           Sender protocol address—Protocol address of the device sending the message.

·           Target hardware address—Hardware address of the device to which the message is being sent.

·           Target protocol address—Protocol address of the device to which the message is being sent.

ARP operating mechanism

As shown in Figure 2, Host A and Host B are on the same subnet. Host A sends a packet to Host B as follows:

1.      Host A looks through the ARP table for an ARP entry for Host B. If one entry is found, Host A uses the MAC address in the entry to encapsulate the IP packet into a data link layer frame. Then Host A sends the frame to Host B.

2.      If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request. The payload of the ARP request comprises the following information:

¡  Sender IP address and sender MAC address—Host A's IP address and MAC address

¡  Target IP address—Host B's IP address

¡  Target MAC address—An all-zero MAC address

All hosts on this subnet can receive the broadcast request, but only the requested host (Host B) processes the request.

3.      Host B compares its own IP address with the target IP address in the ARP request. If they are the same, Host B:

a.    Adds the sender IP address and sender MAC address into its ARP table.

b.    Encapsulates its MAC address into an ARP reply.

c.     Unicasts the ARP reply to Host A.

4.      After receiving the ARP reply, Host A:

a.    Adds the MAC address of Host B into its ARP table.

b.    Encapsulates the MAC address into the packet and sends the packet to Host B.

Figure 2 ARP address resolution process

 

If Host A and Host B are on different subnets, Host A sends a packet to Host B as follows:

1.      Host A broadcasts an ARP request where the target IP address is the IP address of the gateway.

2.      The gateway responds with its MAC address in an ARP reply to Host A.

3.      Host A uses the gateway's MAC address to encapsulate the packet, and then sends the packet to the gateway.

4.      If the gateway has an ARP entry for Host B, it forwards the packet to Host B directly. If not, the gateway broadcasts an ARP request, in which the target IP address is the IP address of Host B.

5.      After the gateway gets the MAC address of Host B, it sends the packet to Host B.

ARP table

An ARP table stores dynamic and static ARP entries.

Dynamic ARP entry

ARP automatically creates and updates dynamic entries. A dynamic ARP entry is removed when its aging timer expires or the output interface goes down. In addition, a dynamic ARP entry can be overwritten by a static ARP entry.

Static ARP entry

A static ARP entry is manually configured and maintained. It does not age out and cannot be overwritten by any dynamic ARP entry.

Static ARP entries protect communication between devices because attack packets cannot modify the IP-to-MAC mapping in a static ARP entry.

Static ARP entries include long, short, and multiport ARP entries.

·           A long static ARP entry comprises the IP address, MAC address, VLAN, and output interface. It is directly used for forwarding packets.

·           A short static ARP entry comprises only the IP address and MAC address.

¡  If the output interface is a Layer 3 Ethernet interface, the short ARP entry can be directly used to forward packets.

¡  If the output interface is a VLAN interface, the device first sends an ARP request whose target IP address is the IP address of the short entry. If the sender IP and MAC addresses in the received ARP reply match the IP and MAC addresses of the short static ARP entry, the device adds the interface that received the ARP reply to the short static ARP entry, and uses the resolved short static ARP entry to forward IP packets.

·           A multiport ARP entry comprises the IP address, MAC address, and VLAN. If a multiport ARP entry has the same MAC address and VLAN as a multicast or multiport unicast MAC address entry, the device can use the multiport ARP entry to send IP packets. A multiport ARP entry is manually configured. It does not age out and cannot be overwritten by any dynamic ARP entry. For more information about multicast MAC, see IP Multicast Configuration Guide.

To communicate with a host by using a fixed IP-to-MAC mapping, configure a short static ARP entry on the device. To communicate with a host by using a fixed IP-to-MAC mapping through a specific interface in a specific VLAN, configure a long static ARP entry on the device.

Configuring a static ARP entry

A static ARP entry is effective when the device works normally. If a VLAN or VLAN interface is deleted, any long static ARP entry in the VLAN is deleted, and any resolved short static ARP entry in the VLAN becomes unresolved.

A resolved short static ARP entry becomes unresolved upon certain events. For example, it becomes unresolved when the resolved output interface goes down.

A long static ARP entry is ineffective if the IP address in the entry conflicts with a local IP address, or no local interface has an IP address in the same subnet as the IP address in the ARP entry. An ineffective long static ARP entry cannot be used to forward packets.

Follow these guidelines when you configure a static ARP entry:

·           The vlan-id argument must be the ID of an existing VLAN where the ARP entry resides. The specified Ethernet interface must belong to that VLAN. The VLAN interface of the VLAN must be created.

·           The IP address of the VLAN interface of the VLAN specified by the vlan-id argument must belong to the same subnet as the IP address specified by the ip-address argument.

To configure a static ARP entry:

 

 

Configuring a multiport ARP entry

A multiport ARP entry comprises an IP address, MAC address, and VLAN ID. To use the multiport ARP entry, you must also configure a multicast or multiport unicast MAC address entry that has the same MAC address and VLAN ID as the multiport ARP entry to specify multiple output interfaces. In addition, the IP address in the multiport ARP entry must reside on the same subnet as the virtual interface of the specified VLAN (VLAN interface). Otherwise, the multiport ARP entry does not take effect. For more information about multiport unicast MAC addresses, see the mac-address multiport command in Layer 2—LAN Switching Command Reference. For more information about multicast MAC addresses, see the mac-address multicast command in IP Multicast Command Reference.

A multiport ARP entry can overwrite a dynamic, short static or long static ARP entry. A short static or long static ARP entry can also overwrite a multiport ARP entry.

To configure a multiport ARP entry:

 

 

Configuring the maximum number of dynamic ARP entries

An interface can dynamically learn ARP entries. To prevent an interface from holding too many ARP entries, you can set the maximum number of dynamic ARP entries that the interface can learn. When the maximum number is reached, the interface stops learning ARP entries.

The Layer 2 interface can learn an ARP entry only when both its maximum number and the VLAN interface's maximum number are not reached.

To set the maximum number of dynamic ARP entries that an interface can learn:

 

 

Setting the aging timer for dynamic ARP entries

Each dynamic ARP entry in the ARP table has a limited lifetime, called aging timer. The aging timer of a dynamic ARP entry is reset each time the dynamic ARP entry is updated. A dynamic ARP entry that is not updated before its aging timer expires is deleted from the ARP table.

To set the aging timer for dynamic ARP entries:

 

 

Enabling dynamic ARP entry check

The dynamic ARP entry check function controls whether the device supports dynamic ARP entries containing multicast MAC addresses.

When dynamic ARP entry check is enabled, the device cannot learn dynamic ARP entries containing multicast MAC addresses, and you cannot manually add static ARP entries containing multicast MAC addresses.

When dynamic ARP entry check is disabled, the device can learn dynamic ARP entries containing multicast MAC addresses obtained from the ARP packets sourced from a unicast MAC address. You can also manually add static ARP entries containing multicast MAC addresses.

To enable dynamic ARP entry check:

 

 

Displaying and maintaining ARP

 

 

Execute display commands in any view and reset commands in user view.

 

 

Static ARP configuration example

 

 

Network requirements

As shown in Figure 3, hosts are connected to the switch, which is connected to the router through interface GigabitEthernet 3/0/1 in VLAN 10.

To ensure secure communications between the router and switch, configure a static ARP entry for the router on the switch.

Figure 3 Network diagram

 

Configuration procedure

# Create VLAN 10.

<Switch> system-view

[Switch] vlan 10

[Switch-vlan10] quit

# Add interface GigabitEthernet 3/0/1 to VLAN 10.

[Switch] interface GigabitEthernet 3/0/1

[Switch-GigabitEthernet3/0/1] port access vlan 10

[Switch-GigabitEthernet3/0/1] quit

# Create VLAN-interface 10 and configure its IP address.

[Switch] interface vlan-interface 10

[Switch-vlan-interface10] ip address 192.168.1.2 8

[Switch-vlan-interface10] quit

# Configure a static ARP entry that has IP address 192.168.1.1, MAC address 00e0-fc01-0000, and output interface GigabitEthernet 3/0/1 in VLAN 10.

[Switch] arp static 192.168.1.1 00e0-fc01-0000 10 GigabitEthernet3/0/1

# Display information about static ARP entries.

[Switch] display arp static

                Type: S-Static    D-Dynamic    I-Invalid

IP Address       MAC Address     VLAN ID  Interface              Aging Type

192.168.1.1      00e0-fc01-0000  10       GigabitEthernet3/0/1   N/A   S 

Multiport ARP entry configuration example

Network requirements

As shown in Figure 4, a switch connects to three servers through interfaces GigabitEthernet 3/0/1, GigabitEthernet 3/0/2, and GigabitEthernet 3/0/3 in VLAN 10. The servers share the IP address 192.168.1.1/24 and MAC address 00e0-fc01-0000.

Configure a multiport ARP entry to send IP packets with destination IP address 192.168.1.1 to the three servers.

Figure 4 Network diagram

 

Configuration procedure

# Create VLAN 10.

<Switch> system-view

[Switch] vlan 10

[Switch-vlan10] quit

# Add GigabitEthernet 3/0/1, GigabitEthernet 3/0/2, and GigabitEthernet 3/0/3 to VLAN 10.

[Switch] interface GigabitEthernet 3/0/1

[Switch-GigabitEthernet3/0/1] port access vlan 10

[Switch-GigabitEthernet3/0/1] quit

[Switch] interface GigabitEthernet 3/0/2

[Switch-GigabitEthernet3/0/2] port access vlan 10

[Switch-GigabitEthernet3/0/2] quit

[Switch] interface GigabitEthernet 3/0/3

[Switch-GigabitEthernet3/0/3] port access vlan 10

[Switch-GigabitEthernet3/0/3] quit

# Create VLAN-interface 10 and specify its IP address.

[Switch] interface vlan-interface 10

[Switch-vlan-interface10] ip address 192.168.1.2 24

[Switch-vlan-interface10] quit

# Configure a multiport unicast MAC address entry that has MAC address 00e0-fc01-0000, and output interfaces GigabitEthernet 3/0/1, GigabitEthernet 3/0/2, and GigabitEthernet 3/0/3 in VLAN 10.

[Switch] mac-address multiport 00e0-fc01-0000 interface GigabitEthernet 3/0/1 to GigabitEthernet 3/0/3 vlan 10

# Configure a multiport ARP entry with IP address 192.168.1.1 and MAC address 00e0-fc01-0000.

[Switch] arp multiport 192.168.1.1 00e0-fc01-0000 10

# Display ARP information.

[Switch] display arp

          Type: S-Static    D-Dynamic    M-Multiport    I-Invalid

IP Address       MAC Address     VLAN     Interface              Aging Type

192.168.1.1      00e0-fc01-0000  10       N/A                    N/A   M

 

Overview

In a gratuitous ARP packet, the sender IP address and the target IP address are the IP address of the sending device.

A device sends a gratuitous ARP packet for either of the following purposes:

·           Determine whether its IP address is already used by another device. If the IP address is already used, the device is informed of the conflict by an ARP reply.

·           Inform other devices of a MAC address change.

Gratuitous ARP packet learning

This feature enables a device to create or update ARP entries by using the sender IP and MAC addresses in received gratuitous ARP packets.

When this feature is disabled, the device uses received gratuitous ARP packets to update existing ARP entries only.

Periodic sending of gratuitous ARP packets

Enabling a device to periodically send gratuitous ARP packets helps downstream devices update ARP entries or MAC entries in a timely manner. This feature can be used to prevent gateway spoofing, prevent ARP entries from aging out, and prevent the virtual IP address of a VRRP group from being used by a host.

·           Prevent gateway spoofing.

An attacker can use the gateway address to send gratuitous ARP packets to the hosts on a network, so that the traffic destined for the gateway from the hosts is sent to the attacker instead. As a result, the hosts cannot access the external network.

To prevent such gateway spoofing attacks, you can enable the gateway to send gratuitous ARP packets containing its primary IP address and manually configured secondary IP addresses at a specific interval, so hosts can learn correct gateway address information.

·           Prevent ARP entries from aging out.

If network traffic is heavy or if the host CPU usage is high, received ARP packets can be discarded or are not promptly processed. Eventually, the dynamic ARP entries on the receiving host age out and the traffic between the host and the corresponding devices is interrupted until the host re-creates the ARP entries.

To prevent this problem, you can enable the gateway to send gratuitous ARP packets periodically. The gratuitous ARP packets contain the gateway's primary IP address or one of its manually configured secondary IP addresses, so the receiving hosts can update ARP entries in time.

·           Prevent the virtual IP address of a VRRP group from being used by a host.

The master router of a VRRP group can periodically send gratuitous ARP packets to the hosts on the local network, so that the hosts can update local ARP entries and avoid using the virtual IP address of the VRRP group. For more information about VRRP, see High Availability Configuration Guide.

¡  If the virtual IP address of the VRRP group is associated with a virtual MAC address, the sender MAC address in the gratuitous ARP packet is the virtual MAC address of the virtual router.

¡  If the virtual IP address of the VRRP group is associated with the real MAC address of an interface, the sender MAC address in the gratuitous ARP packet is the MAC address of the interface on the master router in the VRRP group.

·           Update MAC entries of devices in the VLANs having ambiguous VLAN termination configured.

In VRRP configuration, if ambiguous VLAN termination is configured for many VLANs and VRRP groups, interfaces configured with VLAN termination need to be disabled from transmitting broadcast/multicast packets. Also, a VRRP control VLAN needs to be configured so that VRRP advertisements can be transmitted within the control VLAN only. In such cases, you can enable periodic sending of gratuitous ARP packets containing the VRRP virtual IP address, and the primary IP address or a manually configured secondary IP address of the sending interface on the subinterfaces. In this way, when a VRRP failover occurs, devices in the VLANs having ambiguous VLAN termination configured can use the gratuitous ARP packets to update their corresponding MAC entries in time.

Configuration procedure

The following conditions apply to the gratuitous ARP configuration:

·           You can enable periodic sending of gratuitous ARP packets on up to 1024 interfaces.

·           Periodic sending of gratuitous ARP packets takes effect only when the link of the enabled interface goes up and an IP address has been assigned to the interface.

·           If you change the interval for sending gratuitous ARP packets, the configuration is effective at the next sending interval.

·           The frequency of sending gratuitous ARP packets may be much lower than the sending interval set by the user in any of the following circumstances:

¡  This function is enabled on multiple interfaces.

¡  Each interface is configured with multiple secondary IP addresses.

¡  A small sending interval is configured when the previous two conditions exist.

To configure gratuitous ARP:

 

 

Proxy ARP enables a device on one network to answer ARP requests for an IP address on another network. With proxy ARP, hosts on different broadcast domains can communicate with each other as they would on the same broadcast domain.

Proxy ARP includes common proxy ARP and local proxy ARP.

·           Common proxy ARP—Allows communication between hosts that connect to different Layer 3 interfaces and reside in different broadcast domains.

·           Local proxy ARP—Allows communication between hosts that connect to the same Layer 3 interface and reside in different broadcast domains.

Enabling common proxy ARP

You can enable common proxy ARP in VLAN interface view, Layer 3 Ethernet interface view, Layer 3 Ethernet subinterface view, Layer 3 aggregate interface view, and Layer 3 aggregate subinterface view.

To enable common proxy ARP:

 

 

Enabling local proxy ARP

You can enable local proxy ARP in VLAN interface view, Layer 3 Ethernet interface view, Layer 3 Ethernet subinterface view, Layer 3 aggregate interface view, and Layer 3 aggregate subinterface view.

To enable local proxy ARP:

 

 

Displaying proxy ARP 

Execute display commands in any view.

 

 

Common proxy ARP configuration example

 

 

Network requirements

As shown in Figure 5, Host A and Host D have the same IP prefix and mask, but they are located on different subnets separated by the switch (Host A belongs to VLAN 1, and Host D belongs to VLAN 2). No default gateway is configured on Host A and Host D.

Configure common proxy ARP on the switch to enable communication between the two hosts.

Figure 5 Network diagram

 

Configuration procedure

# Create VLAN 2.

<Switch> system-view

[Switch] vlan 2

[Switch-vlan2] quit

# Configure the IP address of VLAN-interface 1.

[Switch] interface vlan-interface 1

[Switch-Vlan-interface1] ip address 192.168.10.99 255.255.255.0

# Enable common proxy ARP on VLAN-interface 1.

[Switch-Vlan-interface1] proxy-arp enable

[Switch-Vlan-interface1] quit

# Configure the IP address of VLAN-interface 2.

[Switch] interface vlan-interface 2

[Switch-Vlan-interface2] ip address 192.168.20.99 255.255.255.0

# Enable common proxy ARP on VLAN-interface 2.

[Switch-Vlan-interface2] proxy-arp enable

After the configuration, Host A and Host D can ping each other.

ARP snooping is used in Layer 2 switching networks. It creates ARP snooping entries by using information in ARP packets. ARP fast-reply and manual-mode MFF (MAC–Forced Forwarding) can use the ARP snooping entries.

If you enable ARP snooping on a VLAN, ARP packets received by any interface in the VLAN are redirected to the CPU. The CPU uses the sender IP and MAC addresses of the ARP packets, and receiving VLAN and port to create ARP snooping entries.

The aging time and valid period of an ARP snooping entry are 25 minutes and 15 minutes. If an ARP snooping entry is not updated in 15 minutes, it becomes invalid and cannot be used. After that, if an ARP packet matching the entry is received, the entry becomes valid, and its aging timer restarts. If the aging timer of an ARP entry expires, the entry is removed.

If the ARP snooping device receives an ARP packet that has the same sender IP address as a valid ARP snooping entry, but with a different sender MAC address, it assumes it has been attacked. The ARP snooping entry becomes invalid, and is removed after 25 minutes.

Configuration procedure

To enable ARP snooping:

 

 

Displaying and maintaining ARP snooping

Execute display commands in any view and reset commands in user view.