04-Network Connectivity

HomeSupportResource CenterH3C Access Points Cloud Mode Configuration Guides(E2442 R2442)-6W10004-Network Connectivity
11-ARP configuration
Title Size Download
11-ARP configuration 169.69 KB

Configuring ARP

About ARP

ARP resolves IP addresses into MAC addresses on Ethernet networks.

ARP message format

ARP uses two types of messages: ARP request and ARP reply. Figure 1 shows the format of ARP request/reply messages. Numbers in the figure refer to field lengths.

Figure 1 ARP message format

·     Hardware type—Hardware address type. The value 1 represents Ethernet.

·     Protocol type—Type of the protocol address to be mapped. The hexadecimal value 0x0800 represents IP.

·     Hardware address length and protocol address length—Length, in bytes, of a hardware address and a protocol address. For an Ethernet address, the value of the hardware address length field is 6. For an IPv4 address, the value of the protocol address length field is 4.

·     OP—Operation code, which describes the type of ARP message. The value 1 represents an ARP request, and the value 2 represents an ARP reply.

·     Sender hardware address—Hardware address of the device sending the message.

·     Sender protocol address—Protocol address of the device sending the message.

·     Target hardware address—Hardware address of the device to which the message is being sent.

·     Target protocol address—Protocol address of the device to which the message is being sent.

ARP operating mechanism

As shown in Figure 2, Host A and Host B are on the same subnet. Host A sends a packet to Host B as follows:

1.     Host A looks through the ARP table for an ARP entry for Host B. If one entry is found, Host A uses the MAC address in the entry to encapsulate the IP packet into a data link layer frame. Then Host A sends the frame to Host B.

2.     If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request. The payload of the ARP request contains the following information:

¡     Sender IP address and sender MAC address—Host A's IP address and MAC address.

¡     Target IP address—Host B's IP address.

¡     Target MAC address—An all-zero MAC address.

All hosts on this subnet can receive the broadcast request, but only the requested host (Host B) processes the request.

3.     Host B compares its own IP address with the target IP address in the ARP request. If they are the same, Host B operates as follows:

a.     Adds the sender IP address and sender MAC address into its ARP table.

b.     Encapsulates its MAC address into an ARP reply.

c.     Unicasts the ARP reply to Host A.

4.     After receiving the ARP reply, Host A operates as follows:

a.     Adds the MAC address of Host B into its ARP table.

b.     Encapsulates the MAC address into the packet and sends the packet to Host B.

Figure 2 ARP address resolution process

If Host A and Host B are on different subnets, Host A sends a packet to Host B as follows:

1.     Host A broadcasts an ARP request where the target IP address is the IP address of the gateway.

2.     The gateway responds with its MAC address in an ARP reply to Host A.

3.     Host A uses the gateway's MAC address to encapsulate the packet, and then sends the packet to the gateway.

4.     If the gateway has an ARP entry for Host B, it forwards the packet to Host B directly. If not, the gateway broadcasts an ARP request, in which the target IP address is the IP address of Host B.

5.     After the gateway gets the MAC address of Host B, it sends the packet to Host B.

ARP entry types

An ARP table stores dynamic ARP entries Rule ARP entries, and static ARP entries.

Dynamic ARP entry

ARP automatically creates and updates dynamic entries. A dynamic ARP entry is removed when its aging timer expires or the output interface goes down. In addition, a dynamic ARP entry can be overwritten by a static ARP entry.

Static ARP entry

A static ARP entry is manually configured and maintained. It does not age out and cannot be overwritten by any dynamic ARP entry.

Static ARP entries protect communication between devices because attack packets cannot modify the IP-to-MAC mapping in a static ARP entry.

The device supports the following types of static ARP entries:

·     Long static ARP entry—It is directly used for forwarding packets. A long static ARP entry contains the IP address, MAC address, and one of the following combinations:

¡     VLAN and output interface.

¡     Input and output interfaces.

·     Short static ARP entry—It contains only the IP address and MAC address.

If the output interface is a VLAN interface, the device sends an ARP request whose target IP address is the IP address in the short entry. If the sender IP and MAC addresses in the received ARP reply match the short static ARP entry, the device performs the following operations:

¡     Adds the interface that received the ARP reply to the short static ARP entry.

¡     Uses the resolved short static ARP entry to forward IP packets.

To communicate with a host by using a fixed IP-to-MAC mapping, configure a short static ARP entry on the device. To communicate with a host by using a fixed IP-to-MAC mapping through an interface in a VLAN, configure a long static ARP entry on the device.

Rule ARP entry

Rule ARP entries can be directly used for packet forwarding. A Rule ARP entry does not age out, and it cannot be updated. It can be overwritten by a static ARP entry.

ARP creates Rule ARP entries by learning from the following modules:

·     Portal. For more information about portal, see Security Configuration Guide.

ARP tasks at a glance

All ARP tasks are optional.

·     Configuring a static ARP entry

¡     Configuring a short static ARP entry

¡     Configuring a long static ARP entry

·     Configuring features for dynamic ARP entries

¡     Setting the dynamic ARP learning limit for a device

¡     Setting the dynamic ARP learning limit for an interface

¡     Setting the aging timer for dynamic ARP entries

·     Enabling dynamic ARP entry check

·     Enabling ARP logging

Configuring a static ARP entry

Static ARP entries are effective when the device functions correctly.

Configuring a short static ARP entry

Restrictions and guidelines

A resolved short static ARP entry becomes unresolved upon certain events, for example, when the resolved output interface goes down, or the corresponding VLAN or VLAN interface is deleted.

Procedure

1.     Enter system view.

system-view

2.     Configure a short static ARP entry.

arp static ip-address mac-address

Configuring a long static ARP entry

About this task

Long static ARP entries can be effective or ineffective. Ineffective long static ARP entries cannot be used for packet forwarding. A long static ARP entry is ineffective when any of the following conditions exists:

·     The IP address in the entry conflicts with a local IP address.

·     No local interface has an IP address in the same subnet as the IP address in the ARP entry.

A long static ARP entry in a VLAN is deleted if the VLAN or VLAN interface is deleted.

Procedure

1.     Enter system view.

system-view

2.     Configure a long static ARP entry.

arp static ip-address mac-address [ vlan-id interface-type interface-number ]

Configuring features for dynamic ARP entries

Setting the dynamic ARP learning limit for a device

About this task

A device can dynamically learn ARP entries. To prevent a device from holding too many ARP entries, you can set the maximum number of dynamic ARP entries that the device can learn. When the limit is reached, the device stops ARP learning.

If you set a value lower than the number of existing dynamic ARP entries, the device does not delete the existing entries unless they age out. You can use the reset arp dynamic command to clear dynamic ARP entries.

Procedure

1.     Enter system view.

system-view

2.     Set the dynamic ARP learning limit for the device.

arp max-learning-number max-number

By default, a device can learn a maximum of 2048 dynamic ARP entries.

To disable the device from dynamic ARP learning, set the value to 0.

Setting the dynamic ARP learning limit for an interface

About this task

An interface can dynamically learn ARP entries. To prevent an interface from holding too many ARP entries, you can set the maximum number of dynamic ARP entries that the interface can learn. When the limit is reached, the interface stops ARP learning.

You can set limits for both a Layer 2 interface and the VLAN interface for a permitted VLAN on the Layer 2 interface. The Layer 2 interface learns an ARP entry only when neither limit is reached.

The total dynamic ARP learning limit for all interfaces will not be higher than the dynamic ARP learning limit for the device.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Set the dynamic ARP learning limit for the interface.

arp max-learning-num max-number

By default, an interface can learn a maximum of 2048 dynamic ARP entries.

To disable the interface from dynamic ARP learning, set the value to 0.

Setting the aging timer for dynamic ARP entries

About this task

Each dynamic ARP entry in the ARP table has a limited lifetime, called an aging timer. The aging timer of a dynamic ARP entry is reset each time the dynamic ARP entry is updated. A dynamic ARP entry that is not updated before its aging timer expires is deleted from the ARP table.

Procedure

1.     Enter system view.

system-view

2.     Set the aging timer for dynamic ARP entries.

arp timer aging aging-time

The default setting is 20 minutes.

Enabling dynamic ARP entry check

About this task

The dynamic ARP entry check feature disables the device from supporting dynamic ARP entries that contain multicast MAC addresses. The device cannot learn dynamic ARP entries containing multicast MAC addresses. You cannot manually add static ARP entries containing multicast MAC addresses.

When dynamic ARP entry check is disabled, ARP entries containing multicast MAC addresses are supported. The device can learn dynamic ARP entries containing multicast MAC addresses obtained from the ARP packets sourced from a unicast MAC address. You can also manually add static ARP entries containing multicast MAC addresses.

Procedure

1.     Enter system view.

system-view

2.     Enable dynamic ARP entry check.

arp check enable

By default, dynamic ARP entry check is enabled.

Enabling ARP logging

About this task

This feature enables a device to log ARP events when ARP cannot resolve IP addresses correctly. The log information helps administrators locate and solve problems. The device can log the following ARP events:

·     On a proxy ARP-disabled interface, the target IP address of a received ARP packet is not one of the following IP addresses:

¡     The IP address of the receiving interface.

¡     The public IP address after NAT.

·     The sender IP address of a received ARP reply conflicts with one of the following IP addresses:

¡     The IP address of the receiving interface.

¡     The public IP address after NAT.

The device sends ARP log messages to the information center. You can use the info-center source command to specify the log output rules for the information center. For more information about information center, see System Management Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Enable ARP logging.

arp check log enable

By default, ARP logging is disabled.

Display and maintenance commands for ARP

IMPORTANT

IMPORTANT:

Clearing ARP entries from the ARP table might cause communication failures. Make sure the entries to be cleared do not affect current communications.

Execute display commands in any view and reset commands in user view.

 

Task

Command

Display ARP entries.

display arp [ [ all | dynamic | static ] | vlan vlan-id | interface interface-type interface-number ] [ count | verbose ]

Display the ARP entry for an IP address.

display arp ip-address [ verbose ]

Display the aging timer of dynamic ARP entries.

display arp timer aging

Clear ARP entries from the ARP table.

reset arp { all | dynamic | interface interface-type interface-number | static }

ARP configuration examples

Example: Configuring a static ARP entry

Network configuration

As shown in Figure 3, hosts are connected to the AP. The AP is connected to the router through GigabitEthernet 1/0/1 in VLAN 10.

To ensure secure communications between the router and the AP, configure a static ARP entry for the router on the AP.

Figure 3 Network diagram

 

Procedure

# Configure the wireless service on the AP. For more information, see WLAN Access Configuration Guide.

# Create VLAN 10.

<AP> system-view

[AP] vlan 10

[AP-vlan10] quit

# Add interface GigabitEthernet 1/0/1 to VLAN 10.

[AP] interface gigabitethernet 1/0/1

[AP-GigabitEthernet1/0/1] port access vlan 10

[AP-GigabitEthernet1/0/1] quit

# Create VLAN-interface 10 and configure its IP address.

[AP] interface vlan-interface 10

[AP-vlan-interface10] ip address 192.168.1.2 8

[AP-vlan-interface10] quit

# Configure a static ARP entry that has IP address 192.168.1.1, MAC address 00e0-fc01-0000, and output interface GigabitEthernet 1/0/1 in VLAN 10.

[AP] arp static 192.168.1.1 00e0-fc01-0000 10 gigabitethernet 1/0/1

Verifying the configuration

# Verify that the AP has a long static ARP entry for the router.

[AP] display arp static

  Type: S-Static   D-Dynamic   O-Openflow   R-Rule          I-Invalid

IP Address       MAC Address    SVLAN/VSI Interface/Link ID        Aging Type

192.168.1.1      00e0-fc01-0000 10         GE1/0/1                 --    S


Configuring gratuitous ARP

About gratuitous ARP

In a gratuitous ARP packet, the sender IP address and the target IP address are the IP address of the sending device.

A device sends a gratuitous ARP packet for either of the following purposes:

·     Determine whether its IP address is already used by another device. If the IP address is already used, the device is informed of the conflict by an ARP reply.

·     Inform other devices of a MAC address change.

IP conflict detection

When an interface obtains an IP address, the device broadcasts gratuitous ARP packets in the LAN where the interface resides. If the device receives an ARP reply, its IP address conflicts with the IP address of another device in the LAN. The device displays a log message about the conflict and informs the administrator to change the IP address. The device will not use the conflicting IP address. If no ARP reply is received, the device uses the IP address.

Gratuitous ARP packet learning

This feature enables a device to create or update ARP entries by using the sender IP and MAC addresses in received gratuitous ARP packets.

When this feature is disabled, the device uses received gratuitous ARP packets to update existing ARP entries only. ARP entries are not created based on the received gratuitous ARP packets, which saves ARP table space.

Periodic sending of gratuitous ARP packets

Periodic sending of gratuitous ARP packets helps downstream devices update ARP entries or MAC entries in a timely manner.

This feature can implement the following functions:

·     Prevent gateway spoofing.

Gateway spoofing occurs when an attacker uses the gateway address to send gratuitous ARP packets to the hosts on a network. The traffic destined for the gateway from the hosts is sent to the attacker instead. As a result, the hosts cannot access the external network.

To prevent such gateway spoofing attacks, you can enable the gateway to send gratuitous ARP packets at intervals. Gratuitous ARP packets contain the primary IP address and manually configured secondary IP addresses of the gateway, so hosts can learn correct gateway information.

·     Prevent ARP entries from aging out.

If network traffic is heavy or if the host CPU usage is high, received ARP packets can be discarded or are not promptly processed. Eventually, the dynamic ARP entries on the receiving host age out. The traffic between the host and the corresponding devices is interrupted until the host re-creates the ARP entries.

To prevent this problem, you can enable the gateway to send gratuitous ARP packets periodically. Gratuitous ARP packets contain the primary IP address and manually configured secondary IP addresses of the gateway, so the receiving hosts can update ARP entries in a timely manner.

Gratuitous ARP tasks at a glance

All gratuitous ARP tasks are optional. If all of the following features are disabled, gratuitous ARP still provides the IP conflict detection function.

·     Enabling IP conflict notification

·     Enabling gratuitous ARP packet learning

·     Enabling periodic sending of gratuitous ARP packets

·     Enabling sending gratuitous ARP packets for ARP requests with sender IP address on a different subnet

·     Configuring gratuitous ARP packet retransmission for the device MAC address change

Enabling IP conflict notification

About this task

Upon detecting an IP conflict, the device will sends a gratuitous ARP request. By default, the device displays an error message only after it receives an ARP reply. You can enable this feature to allow the device to display an error message immediately upon detecting an IP conflict.

Procedure

1.     Enter system view.

system-view

2.     Enable IP conflict notification.

arp ip-conflict log prompt

By default, IP conflict notification is disabled.

Enabling gratuitous ARP packet learning

1.     Enter system view.

system-view

2.     Enable gratuitous ARP packet learning.

gratuitous-arp-learning enable

By default, gratuitous ARP packet learning is enabled.

Enabling periodic sending of gratuitous ARP packets

Restrictions and guidelines

·     You can enable periodic sending of gratuitous ARP packets on a maximum of 1024 interfaces.

·     Periodic sending of gratuitous ARP packets takes effect on an interface only when the following conditions are met:

¡     The data link layer state of the interface is up.

¡     The interface has an IP address.

·     If you change the sending interval for gratuitous ARP packets, the configuration takes effect at the next sending interval.

·     The sending interval for gratuitous ARP packets might be much longer than the specified sending interval in any of the following circumstances:

¡     This feature is enabled on multiple interfaces.

¡     Each interface is configured with multiple secondary IP addresses.

¡     A small sending interval is configured when the previous two conditions exist.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable periodic sending of gratuitous ARP packets.

arp send-gratuitous-arp [ interval interval ]

By default, periodic sending of gratuitous ARP packets is disabled.

Enabling sending gratuitous ARP packets for ARP requests with sender IP address on a different subnet

1.     Enter system view.

system-view

2.     Enable the device to send gratuitous ARP packets upon receiving ARP requests whose sender IP address belongs to a different subnet.

gratuitous-arp-sending enable

By default, a device does not send gratuitous ARP packets upon receiving ARP requests whose sender IP address belongs to a different subnet.

Configuring gratuitous ARP packet retransmission for the device MAC address change 

About this task

The device sends a gratuitous ARP packet to inform other devices of its MAC address change. However, the other devices might fail to receive the packet because the device sends the gratuitous ARP packet once only by default. Configure the gratuitous ARP packet retransmission feature to ensure that the other devices can receive the packet.

Procedure

1.     Enter system view.

system-view

2.     Set the times and the interval for retransmitting a gratuitous ARP packet for the device MAC address change.

gratuitous-arp mac-change retransmit times interval seconds

By default, the device sends a gratuitous packet to inform its MAC address change once only.

 


Configuring proxy ARP

About proxy ARP

Proxy ARP enables a device on one network to answer ARP requests for an IP address on another network. With proxy ARP, hosts on different broadcast domains can communicate with each other as they would on the same broadcast domain.

Proxy ARP includes common proxy ARP and local proxy ARP.

·     Common proxy ARP—Allows communication between hosts that connect to different Layer 3 interfaces and reside in different broadcast domains.

·     Local proxy ARP—Allows communication between hosts that connect to the same Layer 3 interface and reside in different broadcast domains.

Enabling common proxy ARP

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

Only VLAN interfaces are supported.

3.     Enable common proxy ARP.

proxy-arp enable

By default, common proxy ARP is disabled.

Enabling local proxy ARP

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

Only VLAN interfaces are supported.

3.     Enable local proxy ARP.

local-proxy-arp enable [ ip-range start-ip-address to end-ip-address ]

By default, local proxy ARP is disabled.

Display and maintenance commands for proxy ARP

Execute display commands in any view.

 

Task

Command

Display common proxy ARP status.

display proxy-arp [ interface interface-type interface-number ]

Display local proxy ARP status.

display local-proxy-arp [ interface interface-type interface-number ]

Common proxy ARP configuration example

Example: Configuring common proxy ARP

Network configuration

As shown in Figure 4, Host A and Host D have the same IP prefix and mask, but they are located on different subnets that are separated by the AP. Host A belongs to VLAN 1, and Host D belongs to VLAN 2. No default gateway is configured on Host A and Host D.

Configure common proxy ARP on the AP to enable communication between the two hosts.

Figure 4 Network diagram

Procedure

# Configure the wireless service on the AP. For more information, see WLAN Access Configuration Guide.

# Create VLAN 2.

<AP> system-view

[AP] vlan 2

[AP-vlan2] quit

# Configure the IP address of VLAN-interface 1.

[AP] interface vlan-interface 1

[AP-Vlan-interface1] ip address 192.168.10.99 255.255.255.0

# Enable common proxy ARP on VLAN-interface 1.

[AP-Vlan-interface1] proxy-arp enable

[AP-Vlan-interface1] quit

# Configure the IP address of VLAN-interface 2.

[AP] interface vlan-interface 2

[AP-Vlan-interface2] ip address 192.168.20.99 255.255.255.0

# Enable common proxy ARP on VLAN-interface 2.

[AP-Vlan-interface2] proxy-arp enable

Verifying the configuration

# Verify that Host A and Host D can ping each other.