2

enter image description here

Hi there, so {unnamed company} has set up some VLSM networks, but they overlap.

So network 1 is 10.15.0.0/16 and network 2 is 10.15.208.0/24.

Now you can see how these overlap:

10.15.0.1 - 254.255

10.15.208.1 - 254

...they both contain 10.15.208.2. Which is the IP of a DC on network 2.

Machines in network 1 can connect to the DC.

My question is... how?

I ran it through a simulation on a packet tracer, and I can see that hosts on network 1 send out an ARP, to which router 0 replies with its own mac address. Why is that? Is it because router 0 has a static route for 10.15.208.0/24?

What also are the implications of this strange set up?

Router0:

 Gateway of last resort is not set
         10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
    C       10.15.0.0/16 is directly connected, FastEthernet0/0
    S       10.15.208.0/24 [1/0] via 192.168.0.2
    C    192.168.0.0/16 is directly connected, FastEthernet0/1


Building configuration...

Current configuration : 557 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
 ip address 10.15.0.1 255.255.0.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.0.1 255.255.0.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 10.15.208.0 255.255.255.0 192.168.0.2 
!
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

Router1:

Gateway of last resort is not set
     10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
S       10.15.0.0/16 [1/0] via 192.168.0.1
C       10.15.208.0/24 is directly connected, FastEthernet0/0
C    192.168.0.0/16 is directly connected, FastEthernet0/1

Building configuration...

Current configuration : 557 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
 ip address 10.15.208.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.0.2 255.255.0.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 10.15.0.0 255.255.0.0 192.168.0.1 
!
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end
3
  • You need to edit the question to include the network device configurations and routing tables.
    – Ron Maupin
    Feb 9 '17 at 15:08
  • 1
    The router is engaging in proxy-arp.
    – rnxrx
    Feb 9 '17 at 15:57
  • Just copy the full results of a show running-config command, paste it into your question, and use the Preformatted Text feature ({}).
    – Ron Maupin
    Feb 9 '17 at 16:02
2

The router is using proxy ARP. This is a feature enabled by default. Since the router knows how to reach the destination address, it will respond on the host's behalf with its own MAC address and all frames from the source will be sent to the router which can then route to the destination.

Cisco Proxy ARP

3
  • Thanks for the answer! I haven't came across this concept yet. Something new to study then!
    – Tom
    Feb 9 '17 at 16:26
  • 1 more question. In my situation, I can put 10.15.208.2 on the 10.15/16 network. So if I were to ARP, and I get 2 responses ( 1 from the router, and 1 from the actual machine)... Which takes precedence? I'm presuming it's the first to answer right? So this configuration is waiting for issues.
    – Tom
    Feb 9 '17 at 16:31
  • The most recent ARP reply will overwrite the older cached entry
    – John K.
    Feb 9 '17 at 18:05
1

Assuming router0 and router1 know about all networks, this is normal behavior.

Routers (Cisco) use the following algorithm to determine where to forward packets

  1. If no route matches the destination address, drop the packet.
  2. If only one route matches the address, forward the packet out the defined interface.
  3. If more than one route exists, use the route with the longest subnet mask (the most specific route).
  4. If more than one route has the most specific route, choose the one with the lowest administrative distance.
  5. If more than one route has the same administrative distance, choose the one with the lowest metric.
  6. If more than one has the lowest metric, alternate among all routes (either per-packet or per-flow, depending on the configuration).
1
  • Thanks for your answer. It seems I was specifically talking about "Proxy-arp". :) Tom.
    – Tom
    Feb 9 '17 at 16:25
1

Your router is participating in Proxy ARP. Proxy ARP occurs when someone answers an ARP Request on behalf of another entity.

In your example, the Router is offering an ARP Response, on behalf of the hosts in the 10.15.208.0/24 network. The router is doing this because it knows how to get to the /24 network because of the static route (ip route 10.15.208.0 255.255.255.0 192.168.0.2).

Here is an illustration of how Proxy ARP works:

Proxy ARP - Practical Networking .net

1
  • 1
    Thanks for your answer, this is a new interesting concept to me! :)
    – Tom
    Feb 9 '17 at 16:29
0

I would say that this is how routers making forwarding decisions. If both of networks are advertised by same routing protocol administrative distance would be same. But smaller network /24 would be preffered so even router know how to reach 10.15.0.0/16 for any IP in network 10.15.208.0/24 would send it to data centre as it's more prefered.

Implication is that network overlap and this could cause serious issues somewhere on the line.

4
  • They're both static routes, so AD would be 0 right? Why is the router responding to ARP though? It has a static route for 10.15.208.0/24, but why would that matter?
    – Tom
    Feb 9 '17 at 15:58
  • 1
    It's responding becouse is configured with Proxy Arp, Static AD is 1. Please check: youtube.com/watch?v=Jf4khlMqZa8 Feb 9 '17 at 16:10
  • Sorry yes, a directly connected is 0.
    – Tom
    Feb 9 '17 at 16:13
  • That's correct. Try to do exersise and disable proxy arp and see what will happen. Feb 9 '17 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.