3

Recently I came across an L3 switch configuration that I thought was a bit strange. So this question is to understand 1) whether these type of configurations are common practice, and 2) whether you see any issues with it.

I will attempt to describe the scenario from a first person narrative, though I claim no credit/blame for this.

I have two separate subnets A and B with identical IPv4 network id (say 130.10.0.0/16). Each network has one L3 switch and uses the same VLAN ID (say 3) for these subnets. For simplicity consider A and B are almost clones of each other.

These two networks must remain separate broadcast domains. There are many IP addresses that are used in both networks. I cannot change IP address of any of the existing nodes.

Now I have to route IP traffic from a newly added node with IP address 130.10.10.221 in network A to a newly added node in network B with IP address 130.10.10.222.

My L3 switches do not support NAT and replacing these switches is not an option.

The only good news so far is that for the new nodes I can chose IP addresses such that they are unique across both A and B. That is 130.10.10.221 exists only in A and 130.10.10.222 exists only in B.

I add a new VLAN 10 on both switches and assign one port on each switch to this VLAN. Assign 10.1.20.1/24 to vlan 10 routing interface (SVI) of switch A and 10.1.20.2/24 to vlan 10 SVI of switch B.

add ip route 130.10.10.222 255.255.255.255 10.1.20.2 on switch A
add ip route 130.10.10.221 255.255.255.255 10.1.20.1 on switch B
enable proxy arp in VLAN 3 on both switches.

Connect the VLAN 10 port on switch A to the VLAN 10 port on switch B.

When 130.10.10.221 ARPs for 130.10.10.222 the router responds because it has a route configured for this destination and proxy ARP is enabled. When the packet destined for 130.10.10.222 reaches switch A, as per IP forwarding rules the static route with the 32 bit subnet mask is the most preferred route (trumping the local vlan 3 with 16 bit subnet mask), and therefore the packet gets forwarded onto switch B via VLAN 10. In switch B 130.10.0.0/16 is a "connected" (or direct) route and therefore the packet gets forwarded into B's VLAN 3. The reverse happens for traffic coming from B to A. Both VLAN 3 s remain separate and 130.10.10.221 in VLAN 3 on switch A can make a TCP connection to 130.10.10.222 in VLAN 3 on switch B. What can possibly go wrong ?

Improve this question
3
  • 1
    That is a kludge, and it doesn't scale. If you only need this between one device on each network, you could use it as a temporary solution, but the real solution is to readdress one or both networks. Also, Proxy ARP is a security hole, which is why it is no longer enabled by default. When you do something like this, you really need to document it to the Nth degree.
    – Ron Maupin ♦
    Commented Jul 15, 2016 at 23:33
  • 1
    Indeed. You can stop right at the mention of proxy-arp. That's a last ditch maneuver that should never be done. If you know exactly what you're doing, fine, but if you have to ask anyone anything about it, DON'T. I have a few proxy-arp stubs in my DC, but I know exactly why.
    – Ricky
    Commented Jul 16, 2016 at 0:22
  • 1
    Those are public IP addresses. The situation you describe does not exist outside of a lab environment. In any case, "Routing between identical subnets" is technically referred to as a clusterFck and might happen within Private IP address ranges during company aquisitions. NAT is often used as a workaround until it gets fixed..
    – Ronnie Smith
    Commented Jul 16, 2016 at 2:02

1 Answer 1

Reset to default
0

What can possibly go wrong ?

Lets say you have devices with ip 130.10.10.10 on both networks. Suppose 130.10.10.10 on network A sends a packet to 130.10.10.222.

The packet is delivered successfuly to 130.10.10.222 on network B which then generates a reply. But the reply is delievered to 130.10.10.10 on network B. Depending on what procotols are in use on the networks that could have "interesting" results.

Improve this answer
2
  • Agree that later addition of a node with conflicting IP (conflicting with the proxy ARP) in either network can break things. However, as stated in the question, the original goal of making two "new" nodes with unique IP addresses across both networks talk was achieved.
    – rakeshdn
    Commented Aug 9, 2016 at 9:03
  • The new nodes will communicate with each other just fine. When things get interesting is if one of the other nodes tries to send traffic over the interconnect.
    – Peter Green
    Commented Aug 9, 2016 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.