ARP does not want to clear up (C1111-8P)

[pro100bear]

Hello,

I already posted this situation previously, but now I think I found out the exact problem.

The ARP does not want to clear up. It is populated up to 15360 entries and stuck. Internet is working only for the websites that were previously opened and saved in APR. There are only two lines in the logs about that:

Dec  3 21:27:25.805: %ARP-4-ARPLEARNTHRES: Learned ARP entries have reached to threshold level 12288
Dec  4 18:39:48.759: %ARP-4-ARPLEARNCROSS: 15360 Learned ARP entries are installed in the ARP table and reached the max limit

My config is the simplest one for this device. There is only NAT, DHCP, DNS. That is basically it. I tried all the 17.x versions and they all have the same problem.

Thank you.

[Richard Burts]

An important question would be why there are so many entries in the arp table. My guess is that your configuration has a static default route and that static route specifies the outbound Ethernet interface but does not specify a next hop. It would be much better if you specify a next hop (or if your outbound interface learns its IP using DHCP then include the dhcp parameter on the static route rather than the interface parameter).

[pro100bear]

Thank you! Can you please tell me more? I thought ARP is not cleared up, because of a bug. I honestly don't remember any mentions about ARP and hops when I read about how to set up NAT on a Cisco router. A few lines form my config:

interface GigabitEthernet0/0/1
 description ISP
 ip address dhcp
 ip nat outside
 ip access-group WAN in
 negotiation auto

interface Vlan1
 ip address 10.0.1.1 255.255.255.0
 ip nat inside

ip http server
ip http authentication local
ip http secure-server
ip forward-protocol nd
ip dns server
ip nat inside source list ACL-WAN-Connection interface GigabitEthernet0/0/1 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/1

ip access-list extended ACL-WAN-Connection
 10 permit ip 10.0.1.0 0.0.0.255 any
ip access-list extended WAN
 10 deny   tcp any any eq www
 20 deny   tcp any any eq 443
 30 deny   tcp any any eq 22
 40 deny   tcp any any eq domain
 90 permit ip any any

[Richard Burts · Accepted solution]

Thank you for the additional information. This issue is not about NAT. And this issue is not about any bug. This issue is how you configured your default route

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/1

When a static route specifies an outbound interface with no next hop (which is what you did) then it forces the router to arp for EVERY remote address. And that fills up the arp table. My suggestion is to change your configuration and to use this

ip route 0.0.0.0 0.0.0.0 dhcp

[pro100bear]

Interesting ...

I changed that and noticed the difference immediately:

Sat Dec 04 2021 15:57:34 GMT-0500 (EST)
===================================================================================
#show arp summary
Total number of entries in the ARP table: 35.
Total number of Dynamic ARP entries: 33.
Total number of Incomplete ARP entries: 0.
Total number of Interface ARP entries: 2.
Total number of Static ARP entries: 0.
Total number of Alias ARP entries: 0.
Total number of Simple Application ARP entries: 0.
Total number of Application Alias ARP entries: 0.
Total number of Application Timer ARP entries: 0.
Maximum limit of Learn ARP entry : 15360.
Maximum configured Learn ARP entry limit : 15360.
Learn ARP Entry Threshold is 12288 and Permit Threshold is 14592.
Total number of Learn ARP entries: 33.
Interface              Entry Count
GigabitEthernet0/0/1             2
Vlan1                           33

Total number is not getting bigger and bigger...

Is it how it is supposed to be?

Thank you again!

[pro100bear]

Unfortunately, now webui thinks the router is not properly configured

I was so close from the best router for my needs.

[Richard Burts]

I am glad that changing the default route as I suggested did change the behavior. And yes I believe that this is now as it supposed to be.

I am puzzled about the other message. In looking at the screen shots I am surprised to notice that Gig0/0/1 is marked as LAN. If it connects to the ISP I would expect it to be marked as WAN. Was it this way before you changed the default route? 

[pro100bear]

---

@Richard Burts wrote:

I am puzzled about the other message. In looking at the screen shots I am surprised to notice that Gig0/0/1 is marked as LAN. If it connects to the ISP I would expect it to be marked as WAN. Was it this way before you changed the default route? 

---

When I change from GigabitEthernet0/0/1 to dhcp, the router changes WAN to LAN and shows wan as unsofigured  though everything is working as expected and nothing is changed in the config file.

0/0/1 goes directly to our ISP and gets dynamic IP.

[Richard Burts]

Thanks for the additional information. I do not understand why changing the default route would change the characterization of the interface from WAN to LAN. And I am not sure that it matters. If things are working then I suggest that you not be concerned about that message in the GUI.

[josbot]

Thank you so much @Richard Burts we were having this same issue and while I didn't try to the

ip route 0.0.0.0 0.0.0.0 dhcp

YET, as this is a production environment. I did clear the arp cache to verify that was the issue this time and next time I will give this a try and see if that resolves the issue.

[Richard Burts]

I am glad that you found this discussion. If you have configured your router with a static default route and the default route specifies the outbound interface (and not any next hop) then you are indeed encountering the same issue. Clearing the arp cache will resolve the immediate problem, but it will occur again.

To fix the problem you need to change the static default route. To minimize the impact of making the change I suggest that first you configure the new static default specifying dhcp and then remove the old static default route which specified only the outbound interface. Doing it this way should mean that traffic would continue to flow. If you remove the old static default route and then configure the new one, there will be a period of time when your router has no default route and traffic would be impacted.