2

I'm watching a video course provided by Cisco, and I came across one interesting part regarding the need of proxy ARP:

If a router uses a static route that uses an outgoing interface instead of a next-hop router IP address, proxy ARP has to be enabled on the next-hop router. Otherwise, the next-hop router will not respond to ARP requests performed by the first-hop router.

So, if I use

ip route 10.1.1.0 255.255.255.0 Gi0/0 

the next hop router must have proxy ARP enabled.

But if I use

ip route 10.1.1.0 255.255.255.0 192.168.1.1

then the next-hop router don't have to have proxy ARP enabled.

How does it work? Even if I use

ip route 10.1.1.0 255.255.255.0 Gi0/0

the local router will perform a recursive lookup and eventually resolve the next hop's IP address as 192.168.1.1, so what is the difference here and why should the next hop router care how I configure static route on the local router?

Is it just a Cisco thing?

  • "the local router will perform a reverse lookup" Reverse lookup of what? No such thing. – Ron Trunk Jun 1 '18 at 16:50
  • i meant recursive lookup lol – kamokoba Jun 1 '18 at 17:24
4

the local router will perform a [recursive] lookup and eventually resolve the next hop's IP address as 192.168.1.1

If you think about that for a minute, you may change your mind. There's nothing to recurse because the next-hop simply isn't known.

With no next hop, the local router has to assume the destination is directly connected. So, it ARPs for the destination address. Unless the next-hop router has Proxy-ARP enabled, it won't respond to the ARP.

Proxy-ARP tells the next-hop router to respond to any ARP for which it has a route. In this case, it will respond to the ARP for the destination address.

2

This seems to be pretty much out of context...

Proxy ARP is required when a non-local destination should appear local to a source. In this case, the source is a router and there is no next-hop route, the destination is supposed to be local to the router. However, it really isn't, so a regular ARP for the local destination would fail (with it being outside the broadcast domain).

In this case the (hidden) next-hop router has to reply to the ARP request on behalf of the destination (proxy ARP) to make it appear local. The proxy-ARP router sends its own MAC instead of the destination's, the IP packet is sent to the router and forwarded to the destination.

An alternative to proxy ARP would be a static ARP table entry on the source router.

Your example doesn't work because the destination is not local to the source router.

If instead the source router had a local interface 10.0.1.1/16 and tried to forward a packet to 10.0.2.20 it would assume the destination is local. However, the destination subnet is really segmented into 10.0.1.0/24 and 10.0.2.0/24 and there's a hidden gateway in between. This gateway would have to answer with its own MAC to the ARP request for the destination's IP and then simply forward the packet.

Usually, ARP trickery is only required when your network has grown out of proportion or isn't designed reasonably. In nearly all situations, a good cleanup or renumbering would be advised.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.