Overlapping VLANs / Router ARP reply

Question

Hi there, so {unnamed company} has set up some VLSM networks, but they overlap.

So network 1 is 10.15.0.0/16 and network 2 is 10.15.208.0/24.

Now you can see how these overlap:

10.15.0.1 - 254.255

10.15.208.1 - 254

...they both contain 10.15.208.2. Which is the IP of a DC on network 2.

Machines in network 1 can connect to the DC.

My question is... how?

I ran it through a simulation on a packet tracer, and I can see that hosts on network 1 send out an ARP, to which router 0 replies with its own mac address. Why is that? Is it because router 0 has a static route for 10.15.208.0/24?

What also are the implications of this strange set up?

Router0:

 Gateway of last resort is not set
         10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
    C       10.15.0.0/16 is directly connected, FastEthernet0/0
    S       10.15.208.0/24 [1/0] via 192.168.0.2
    C    192.168.0.0/16 is directly connected, FastEthernet0/1


Building configuration...

Current configuration : 557 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
 ip address 10.15.0.1 255.255.0.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.0.1 255.255.0.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 10.15.208.0 255.255.255.0 192.168.0.2 
!
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

Router1:

Gateway of last resort is not set
     10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
S       10.15.0.0/16 [1/0] via 192.168.0.1
C       10.15.208.0/24 is directly connected, FastEthernet0/0
C    192.168.0.0/16 is directly connected, FastEthernet0/1

Building configuration...

Current configuration : 557 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
 ip address 10.15.208.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.0.2 255.255.0.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 10.15.0.0 255.255.0.0 192.168.0.1 
!
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

Answer 1

The router is using proxy ARP. This is a feature enabled by default. Since the router knows how to reach the destination address, it will respond on the host's behalf with its own MAC address and all frames from the source will be sent to the router which can then route to the destination.

Cisco Proxy ARP

Answer 2

Assuming router0 and router1 know about all networks, this is normal behavior.

Routers (Cisco) use the following algorithm to determine where to forward packets

1. If no route matches the destination address, drop the packet.
2. If only one route matches the address, forward the packet out the defined interface.
3. If more than one route exists, use the route with the longest subnet mask (the most specific route).
4. If more than one route has the most specific route, choose the one with the lowest administrative distance.
5. If more than one route has the same administrative distance, choose the one with the lowest metric.
6. If more than one has the lowest metric, alternate among all routes (either per-packet or per-flow, depending on the configuration).

Answer 3

Your router is participating in Proxy ARP. Proxy ARP occurs when someone answers an ARP Request on behalf of another entity.

In your example, the Router is offering an ARP Response, on behalf of the hosts in the 10.15.208.0/24 network. The router is doing this because it knows how to get to the /24 network because of the static route (ip route 10.15.208.0 255.255.255.0 192.168.0.2).

Here is an illustration of how Proxy ARP works:

Answer 4

I would say that this is how routers making forwarding decisions. If both of networks are advertised by same routing protocol administrative distance would be same. But smaller network /24 would be preffered so even router know how to reach 10.15.0.0/16 for any IP in network 10.15.208.0/24 would send it to data centre as it's more prefered.

Implication is that network overlap and this could cause serious issues somewhere on the line.