topic ALSO: If they don't make use in Routing and SD-WAN

puzzle: when the ISP refuses to use arp requests...

busitech — Tue, 05 Mar 2019 14:57:57 GMT

I have been having trouble doing something that should be incredibly simple, and now that it has proven difficult, it's a puzzle waiting to be solved.

The ISP has given us a few static addresses to use. We have a Cisco 2800 series router / firewall device. I'd like to assign the first address to the router, and use the rest with NAT / PAT.

With a routed subnet, this would be easy. However, the catch is that the static addresses are within one huge /23 subnet.

Any of the addresses work fine when assigned to the router as the primary address. The other addresses do not work when configured as a secondary address on the same interface as the primary, or with a NAT mapping, unless the second address has been recently used as the primary address of the router, or a physical host in the DMZ. If the address is removed as the primary address, and added to the NAT / PAT configuration we want, an "activated" address will work for many hours and then die, usually within 24 hours.

I decided to log arp packets on the outside interface for a few days. I discovered that the default gateway on the ISP side will never send an arp request for an address that has died off, even though I'm sitting on the other side of the 'net pinging the address. It seems obvious to me that the arp cache has expired on their end, and neither the router nor the ISP is announcing or requesting via arp.

After having had (way too many unproductive) conversions with the ISP, they continually refuse to make any changes on their end. I suggested a static arp entry for our mac address, or to start sending arp requests. I also can't get enough visibility into their configuration.

Does anyone know how to bridge arp announcements (gratuitous arp) from inside to outside, or how to get the 2800 IOS to generate gratuitous arp for the addresses that are used in NAT?

Have you tried NAT without

Masoud Pourshabanian — Wed, 14 Oct 2015 03:05:33 GMT

Have you tried NAT without setting that IP as a secondary address? You do not need to set that IP on the interface when you are mapping your local IP to that IP.

Yes I tried both ways.

busitech — Wed, 14 Oct 2015 05:01:24 GMT

Yes I tried both ways.

Hi, As far as I know, ISP's

Morne Vermeulen — Wed, 14 Oct 2015 07:44:06 GMT

Hi,

As far as I know, ISP's don't like adding static mac entries because of the obvious security risks. MAC spoofing is so easy these days, you don't even have to enter the command line on windows to change a mac. If they tap your line (which in itself has a very low chance of happening, but still possible), whoever the spoofer is will see all traffic on your internet line.

How is the NAT'ing set up? Is your internal range consumed through an access list and natted that way? Or is it the normal nat inside/outside setup running?

Side note: Still new to networking, take my advise with a grain of salt.

Thanks & Regards,
Morne

ALSO: If they don't make use

Morne Vermeulen — Wed, 14 Oct 2015 07:45:11 GMT

ALSO: If they don't make use of arp requests, maybe implementing a routing protocol through to your ISP would be an idea?

If ARPs are blocked, maybe OSPF hello packets or so isnt?

During testing, I've tried 1

busitech — Wed, 14 Oct 2015 08:07:16 GMT

During testing, I've tried 1:1 static NAT, NAT with port mapping (PAT), NAT and PAT with route maps, NAT and PAT with access lists, static arp entries, and assigning secondary address. None of these create the arp traffic the ISP is looking for to activate an address.

It appears the way the ISP is set up right now, the gratuitous arp response that a workstation sends when it boots up, in order to detect duplicate addresses that may exist (and warn the user) and announce it's presence on the subnet (and update the arp tables of adjacent nodes) is what the ISP uses to "turn on" an address.

I can take over any IP address I assign to the 2851... Even those not assigned to us! As a test, I turned on local-proxy-arp (turning on proxy arp for the whole subnet) which allowed the 2851 to answer the arp requests that I do see as a result of any recently released DHCP leases from other clients in the subnet (which happens during the phase out period, as shown in my debug arp logs) and then those unassigned addresses were sent to us fir the duration of the phase out period (as shown by my ping responses from across the 'net).

Hard-coding my router's MAC address on their side would be similar to what cable companies do with a residential cable modem... Their gateway upstream from the customer site will only talk to the MAC address we call in with. When we buy a new cable modem, they turn off one MAC address, and turn on the other.

It is my observation that the way it is now represents the security risk, and I shared that with the ISP yesterday.

What frustrates me is that I can't yet find a way to have the Cisco 2851 (a very nice piece of premium enterprise networking equipment) simulate what the primitive IP stack in Windows XP does when it starts up, on behalf of the public addresses specified as a NAT destination or even secondary IP address. Seems like the Microsoft operating system has one-upped my Cisco gear, which is hard for me to swallow!

Routing protocols is a good

busitech — Wed, 14 Oct 2015 08:13:20 GMT

Routing protocols is a good idea, and on this front I've already tried RIP and BGP. I haven't done anything with OSPF however.

The ISP is not doing there

Jon Marshall — Wed, 14 Oct 2015 09:12:10 GMT

The ISP is not doing their job properly.

They should either -

1) assign you a subnet and you use one of the IPs for the outside interface and the rest for NAT, no need for secondary IPs.

The ISP then needs to arp for all IPs and you need proxy arp enabled on your outside interface

2) assign you two ranges, one for the link between your router and them and the other you can just use for NAT, again no need for secondary IPs.

Then they should simply have a route for the subnet not assigned to the link pointing to the outside interface IP of your router.

If the ISP is refusing to do either then you need a new ISP because it should not be up to you to issue gratuitous arps to them.

Jon

Since the addresses work when

busitech — Wed, 14 Oct 2015 09:15:12 GMT

Since the addresses work when directly assigned to a device in the DMZ, they believe they have done their job. To obtain a subnet from them, we would have to fill out subnet justification forms, and pay an additional monthly fee. The business owner decided to try to make this work, and therein lies the puzzle. : )

...and by explaining their

busitech — Wed, 14 Oct 2015 09:17:55 GMT

...and by explaining their position I do not mean to agree with the ISP, I'm just bringing in the facts as they stand. They may know full well their stance on the matter will force a given client to pay for the premium services.

Can you clarify the first bit

Jon Marshall — Wed, 14 Oct 2015 09:18:00 GMT

Can you clarify the first bit about the DMZ ?

By DMZ do you mean between the router and the ISP ?

Jon

Sure, if I place a Windows PC

busitech — Wed, 14 Oct 2015 09:19:54 GMT

Sure, if I place a Windows PC on a switch outside the 2851, hung directly from the ISP's optic modem, the Windows PC can be assigned any of the "static" addresses that we've been allocated (essentially no more than taken out of their DHCP rotation).

So the ISP must be sending

Jon Marshall — Wed, 14 Oct 2015 09:25:44 GMT

So the ISP must be sending arps for those IPs assigned to you.

Or do you initiate the connection from that PC ?

Jon

Workstations and even the

busitech — Wed, 14 Oct 2015 09:32:27 GMT

Workstations and even the router itself will send an arp announcement for their primary address, and trigger the activation of the address, causing it to work for a while. For a limited time, the ISP gateway will arp to refresh its cache.

However, if the device does not send an arp announcement periodically, this process shuts down and the address dies off. This description is based on experience, testing with addresses in different configurations, and watching the debug arp log on the router on the outside interface.

The only addresses I can keep going are those assigned as the primary on the interface, or on a physical workstation. The NAT / PAT address destinations and secondary addresses both will never "prime the pump". If I change the primary address of the router temporarily, then move it to a NAT destination, the address works perfectly for about 18 hours, then dies.

Any IP used for general

Jon Marshall — Wed, 14 Oct 2015 09:46:02 GMT

Any IP used for general internet access from your users should be updating the ISPs arp cache continuously.

But any static NAT statements for access to internal servers would require some sort of arp from the ISP.

So basically the ISP assigns you extra IPs but you must tell them you are using them with the service you purchased off them (sorry I can be a bit slow on the uptake sometimes :-)).

I am not aware of a way to get a router to send gratuitous arps for IPs used with NAT which is really what you need.

Are you using the additional IPs for one to one mappings between public and private IPs or are you doing port translations ie. using one public IP for many private IPs on different ports ?

Jon

Honestly, if I could get

busitech — Wed, 14 Oct 2015 09:51:24 GMT

Honestly, if I could get either 1:1 or port mapping to work, I'd conform to either method that was compatible. Unfortunately, I started this thread because it looks like a real workstation has an edge over the NAT implementation of IOS, and I'd like to be proven wrong in this assessment.

Well to be fair an end device

Jon Marshall — Wed, 14 Oct 2015 10:03:27 GMT

Well to be fair an end device and a router are doing very different things so I'm not sure one has the edge over another.

If you are doing one to one mappings then a rather messy workaround could be to set up a scheduled job on the end device to ping an internet IP.

As long as the ping ran before the arp entry timed out it would automatically update the ISP's arp cache.

It is by no means an ideal solution and wouldn't work with port mappings but at the moment I am struggling to think of anything else.

Jon

Hi, I hope my input helped in

Morne Vermeulen — Wed, 14 Oct 2015 10:07:27 GMT

Hi,

I hope my input helped in some way. As I stated, still new to networking and how it works.

As screwy as it sounds, I can

busitech — Wed, 14 Oct 2015 10:09:17 GMT

As screwy as it sounds, I can use telnet to port 25, using a 1:1 NAT inside address, see the packet arrive at my own mail server with tcpdump on Linux, from the correct address after NAT, and still not see the return traffic, nor an arp request. It just doesn't activate the IP or wake up the ISP's network to the presence of my now very active address...

It has been suggested to place a Raspberry Pi in the DMZ running arpsend... : )

Sorry I am not following.Do

Jon Marshall — Wed, 14 Oct 2015 10:14:02 GMT

Sorry I am not following.

Do you mean telnet from the internet to the public IP ?

I am just doing a quick lab to see if I can come up with anything but not sure what you mean by the above ?

Also when you refer to DMZ just to clarify you do mean the network between you and the ISP ?

Jon