Recently I came across an L3 switch configuration that I thought was a bit strange. So this question is to understand 1) whether these type of configurations are common practice, and 2) whether you see any issues with it.

I will attempt to describe the scenario from a first person narrative, though I claim no credit/blame for this.

I have two separate subnets A and B with identical IPv4 network id (say Each network has one L3 switch and uses the same VLAN ID (say 3) for these subnets. For simplicity consider A and B are almost clones of each other.

These two networks must remain separate broadcast domains. There are many IP addresses that are used in both networks. I cannot change IP address of any of the existing nodes.

Now I have to route IP traffic from a newly added node with IP address in network A to a newly added node in network B with IP address

My L3 switches do not support NAT and replacing these switches is not an option.

The only good news so far is that for the new nodes I can chose IP addresses such that they are unique across both A and B. That is exists only in A and exists only in B.

I add a new VLAN 10 on both switches and assign one port on each switch to this VLAN. Assign to vlan 10 routing interface (SVI) of switch A and to vlan 10 SVI of switch B.

add ip route on switch A
add ip route on switch B
enable proxy arp in VLAN 3 on both switches.

Connect the VLAN 10 port on switch A to the VLAN 10 port on switch B.

When ARPs for the router responds because it has a route configured for this destination and proxy ARP is enabled. When the packet destined for reaches switch A, as per IP forwarding rules the static route with the 32 bit subnet mask is the most preferred route (trumping the local vlan 3 with 16 bit subnet mask), and therefore the packet gets forwarded onto switch B via VLAN 10. In switch B is a "connected" (or direct) route and therefore the packet gets forwarded into B's VLAN 3. The reverse happens for traffic coming from B to A. Both VLAN 3 s remain separate and in VLAN 3 on switch A can make a TCP connection to in VLAN 3 on switch B. What can possibly go wrong ?

  • 1
    That is a kludge, and it doesn't scale. If you only need this between one device on each network, you could use it as a temporary solution, but the real solution is to readdress one or both networks. Also, Proxy ARP is a security hole, which is why it is no longer enabled by default. When you do something like this, you really need to document it to the Nth degree.
    – Ron Maupin
    Jul 15 '16 at 23:33
  • 1
    Indeed. You can stop right at the mention of proxy-arp. That's a last ditch maneuver that should never be done. If you know exactly what you're doing, fine, but if you have to ask anyone anything about it, DON'T. I have a few proxy-arp stubs in my DC, but I know exactly why.
    – Ricky
    Jul 16 '16 at 0:22
  • 1
    Those are public IP addresses. The situation you describe does not exist outside of a lab environment. In any case, "Routing between identical subnets" is technically referred to as a clusterFck and might happen within Private IP address ranges during company aquisitions. NAT is often used as a workaround until it gets fixed.. Jul 16 '16 at 2:02

What can possibly go wrong ?

Lets say you have devices with ip on both networks. Suppose on network A sends a packet to

The packet is delivered successfuly to on network B which then generates a reply. But the reply is delievered to on network B. Depending on what procotols are in use on the networks that could have "interesting" results.

  • Agree that later addition of a node with conflicting IP (conflicting with the proxy ARP) in either network can break things. However, as stated in the question, the original goal of making two "new" nodes with unique IP addresses across both networks talk was achieved.
    – rakeshdn
    Aug 9 '16 at 9:03
  • The new nodes will communicate with each other just fine. When things get interesting is if one of the other nodes tries to send traffic over the interconnect. Aug 9 '16 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.