Hello,
By default "ARP flooding" will be enabled if you try to set L2 unknown unicast flooding to "Flood" in the BD. These settings have to be enabled for layer 2 traffic to work. Typically, those two options are needed when you are using the bridge domain purely for layer 2 functionality. A typical use case would be if the GW for the EPs tied to this BD lived outside of ACI and traditional ARP flooding was needed. Since this is all L2, we will only learn MAC addresses in that BD. Therefore, HW proxy would not be ideal. We can't proxy for unknown addresses because we don't learn IPs in layer 2 BDs.
Hardware Proxy is a feature that is used to limit the unnecessary amount of broadcasts in the fabric.With hardware proxy, when a packet comes into the local leaf, the leaf will do a local lookup to see if it has information about where the destination IP TEP. If so, it will unicast the packet to the destination TEP. If the destination is not known in the leaf's local cache, the leaf will send the packet to the hardware proxy (function on the spines) which have a full table of all the EP IPs and where they reside. From there, the spine will unicast the packet appropriately. If the spines do not know about the IP it will simply drop the packet. Note: For this feature to work you must have IP routing enabled in the BD.
When you create a subnet under the BD in the "L3 configurations", you are creating an anycast GW. By this I mean this GW will be deployed across all TORs in the fabric wherever this particular BD of a tenant is present. For this GW to be programmed, you also need to have unicast routing enabled. Unicast routing will turn the bridge domain into a L3 bridge domain. This is a common deployment when the GW for the EPs tied to the bridge domain lives on ACI. In a layer 3 BD, we will learn MACs along with the IPs binded to them.
IP Address-Based Routed Traffic (L3)
Recommended bridge domain settings are as follows:
L2 Unknown Unicast—Hardware Proxy
ARP Flooding—Disabled
Unicast Routing—Enabled
Subnet Configured—Yes, if required
Enforce Subnet Check for IP Learning—Yes
In this scenario, most of the bridge domain settings can be left at their default, optimized values.
A subnet (that is, a gateway address) should be configured as required and you should enforce
the subnet check for IP learning.
Non-IP Address-Based Switched Traffic (L2)
Recommended bridge domain settings are as follows:
L2 Unknown Unicast: Flood
ARP Flooding: N/A (enabled automatically due to no unicast routing)
Unicast Routing: Disabled
Subnet Configured: No
Enforce Subnet Check for IP Learning: N/A
In this scenario, all optimizations inside the bridge domain are disabled
and the bridge domain is operating in a "traditional" manner. Silent hosts are dealt with
through normal ARP flooding, which is always enabled when unicast routing is turned off.
Thank you for participating in the Cisco Support Forum for ACI! If you have other questions related to this post, please let us know. If this response answers your questions, please mark this post "answered" and assign a rating to the response(s) provided. This will help notify other viewers that your question(s) is answered and this helps us provide better responses for this and future questions.
Regards,
