0

Not sure if my question is on-topic here. I found the following question about ARP requests from a different subnet and I was wondering if and when this is an actual use case. The original question is about required ACLs for ARP requests. One of the answers is, that an ACL has to be implemented when the ARP request comes from a different subnet.

So my question is: when will that ever be the case? If the target node is within the same subnet the source will broadcast an ARP request, if it's not within the subnet, the packet would be sent to the default gateway. And the receiving router would be either in the correct subnet or would send it to its default gateway.

If the question is off-topic here, maybe you could point me to the correct stack exchange site?!

Improve this question

4 Answers 4

Reset to default
4

I think you misinterpreted the answer. You are correct that ARP requests never come from a different subnet, unless a host is misconfigured.

Improve this answer
2
  • just to clarify, I'm primarily talking about this answer: "When they (the hosts) are on different subnets, then you should have an ACL for allowing the traffic", so its not an ACL to allow ARP?
    – Albin
    Mar 30, 2022 at 16:09
  • Correct. It's not for ARP
    – Ron Trunk
    Mar 30, 2022 at 16:27
3

ARP is a link-scope protocol, as such it will never be forwarded. The only time you'd legitimately see ARPs for addresses outside your interface's subnet is when multiple subnets overlap. (i.e. "secondary" addresses in the cisco world.)

A firewall may require an ACL for those subnets to communicate in either case, as the firewall forwards traffic between them. (hairpinning may require additional configuration.)

Improve this answer
2

The linked question asks

Does firewall block arp requests by default?

Does firewall block arp requests by default? If 2 hosts need to communicate via arp that are firewalled, should we create a ACL to allow arp traffic

Most often, a firewall is implemented as or on a router - your question indicates that as you talk about different subenets. A router works on the network layer (OSI L3) and forwards packets by their destination IP address. For that, it may use ARP on any interface (where a MAC-based network is connected). Since ARP requests are broadcasted, these broadcasts never cross the router/firewall.

If a firewall is implemented in a 'transparent' way (basically as an L2 switch), it should provide ways to filter or block ARP requests (generally, by sender MAC, destination MAC, ...). Whether a transparent firewall blocks ARP by default depends on its implementation.

Improve this answer
1
  • Thanks for the answer, just to clarify, I'm not the author of the linked question. I'm primarily talking about this answer: "When they (the hosts) are on different subnets, then you should have an ACL for allowing the traffic" which confused me, why would you need an ACL for ARP requests from a different subnet (that shouldn't arrive anyway). But I think Ron is right I probably misinterpreted the answer.
    – Albin
    Mar 30, 2022 at 16:07
1

The other answers are all correct but it may help to phrase it a bit differently.

The correct answer to...

What if they are on different subnets (vlans)

...is that ARP doesn't cross subnets.

ARP is for resolving IPs to MAC addresses on a layer-2 network. If host1 on network1 needs to reach host2 on network2, it doesn't ARP for host2, it ARPs for it's default gateway on network1. Host2 isn't involved in that, nor is any firewall unless the firewall is the default gateway.

The exceptions are a firewall in transparent mode and multiple subnets on the same VLAN. In the first case you may need to configure an ACL, it would depend on the firewall's default behavior. In the second case, if host1 and host2 were on the same VLAN but different subnets then host1 would still ARP for it's gateway, host2 would see the broadcast but it wouldn't be for it's IP so it would ignore it.

Another exception that I saw a long time ago was a network where every host was configured as it's own default gateway. The hosts would then ARP for every address and the router would respond because proxy ARP was enabled. That was 20 years ago and I'm sure there was reason it was done that way but I don't remember what it was.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.