Accepted Solutions
I think there is a bit of confusion about ARP Glean process. Allow me to try and clarify how it works:
ARP Gleaning, known also as Silent Host Detection mechanism, represents the process in which the ACI Spines generates an ARP request for a destination IP which does not exists in the COOP database. How does the traffic reaches the Spines in the first place? Well, that is called Spine Proxy, and refers to the situation when the Leaf does not know either the dMAC or the dIP in it's endpoint table (unknown unicast), and needs to send it to Spine to take a forwarding decision. The decision to forward it to spines for L2 traffic is based on BD configuration. While for L3 traffic is based on the pervasive route always configured on the Leaf switch.
And since there are different situations depending on the type of traffic (L2 or L3), this is from ACI whitepaper:
- For (L2) switched traffic to an unknown MAC, the L2 Unknown Unicast option under the BD may need to be set to “Flood”. This is because the ACI fabric with the L2 Unknown Unicast “Hardware-Proxy” configuration drops the L2 unicast packets on the spine in cases where the destination MAC has not been learned as an endpoint anywhere on the BD in ACI, and the COOP database doesn’t have the information.
- For (L3) routed traffic to an unknown IP, the ACI leaf will generate an ARP request from its BD SVI (pervasive gateway) IP toward the unknown IP in order to detect and learn the unknown IP. Only the leaf with BD SVI IP for the unknown IP subnet will generate an ARP request. This behavior is originally triggered by the spine when the spine couldn’t find the unknown IP, even in the COOP database. This behavior is called silent host detection, or ARP gleaning. This behavior for (L3) routed traffic happens regardless of configuration, such as L2 Unknown Unicast or ARP flooding (mentioned below), as long as the traffic is routed to an unknown IP.
- For ARP requests with a broadcast destination MAC, the ARP flooding option under the BD controls the flooding behavior. The ACI fabric will flood the ARP request within the BD when the ARP flooding option is enabled. Because the frame is flooded to the entire BD, any silent host would receive the packet and respond appropriately. In cases where the ARP flooding option is disabled, the ACI fabric will perform unicast routing against the target IP located in the ARP header instead of flooding. If the target IP is a silent host and unknown to the leaf and spines (COOP), the ACI leaf switches will follow the same procedure as the (L3) routed traffic scenario discussed earlier (ARP gleaning) and generate an ARP request from its BD SVI (pervasive gateway), even if the target IP and the source IP are in the same subnet. This implies that both enabling and disabling the ARP flooding option can detect most silent hosts.
But since most of the times a pictures is worth a thousand words, you might find the next diagram taken from best ciscolive presentation BRKACI-3545 - Mastering ACI Forwarding more informative:
If there are things which are still not clear, let us know.
Stay safe,
Sergiu
