If defualt gateway is not configured.

[NetworkingGeek1]

Hello community,

I have a question regarding default gateway. If L2 switch (the same applies to L3 switch & Router with disabled routing and any other host with IP which can't route) doesn't have default gateway configured, how it will reply to packets which destined to the network which is not directly connected to it? I think, switch will consider this destination as directly connected network and will ARP for this destination and if there is device witch knows how to get to that network and have Proxy ARP enabled, will reply with its MAC address. What about situations, when Switch (or any other host) has more than one interface with IP (same conditions: IP routing disabled, no default gateway configured, destination network is not directly connected), from which interface it sends ARP requests?

[paul driver]

Hello
When a switch is purely switching it is classed as a host switch and requires no ip addressing, The only reason why you provide a Layer 2 switch ip addressing/subnet mask/default-gateway is to remotely manage it nothing more, it has no involvement in any routing process.

When the switch has ip routing enabled, the default-gateway becomes irrelevant but now it is capable of actively participating in the route process (static/dynamic) which will enable you to create multiple L3 switch virtual interfaces(SVIs) or routed ports on the switch (platform dependant) enabling the it to route between those interfaces.

Now if you have these multiple interfaces with/without any static or dynamic routing applied and  you decide turn ip routing off, you will lose all route processing capability (static/dynamic routes) and it then the switch becomes a host switch once more. 

[NetworkingGeek1]

Hello @paul driver 

My question is about switch which is L2, but has IP interfaces just like PC for example. Switch needs IP not only for management, but also for SNMP, Tacacs, NTP, etc. All my questions implies that switch can't do routing. So, my questions are: If switch doesn't have default gateway configured, how is it going to reach networks (remote networks) which are not part of its interface?

[paul driver]

It wont be able to, it will need a default-gateway for a next-hop for any remote MGT connectivity, without it, then it will be reliant on a routed device connected to the same subnet to proxy arp for it and chances are it still wont work

[NetworkingGeek1]

In order for Proxy ARP router to reply it needs get ARP request from the switch. So, my question out of which interface switch is going to send request?

[paul driver]

Hello
Any active port associated with the L3 svi of the switch or any routed port (if supported)

[Joseph W. Doherty]

" . . . how it will reply to packets which destined to the network which is not directly connected to it?"

" I think, switch will consider this destination as directly connected network and will ARP for this destination and if there is device witch knows how to get to that network and have Proxy ARP enabled, will reply with its MAC address."

Yes, but if host has a network mask, it will know what's considered on its own network vs. not its own network.  (Keep in mind, networks not the host's might still be on/within the same L2 broadcast domain, so for those on the same L2 broadcast domain, ARPing works fine, no proxy router needed, and if proxy router, ARPing works for non host network physically within same L2 broadcast domain, and those "beyond" the proxy router.)

"What about situations, when Switch (or any other host) has more than one interface with IP (same conditions: IP routing disabled, no default gateway configured, destination network is not directly connected), from which interface it sends ARP requests?"

Good question. Could work the same for any active NIC.  Unsure for such a multi-homed host, whether it somehow has a connected network interface it only uses for non-connected networks, ARPs on all interfaces, concurrently, or works through the sequence of interfaces, when an ARP "fails".  (Have very rarely had to work/support multi-homed hosts.  Don't recall ever having one without at least one gateway IP.)

[NetworkingGeek1]

Hello @Joseph W. Doherty  Thank you for the reply.

I did some tests with Virtual Router. I disabled IP routing to make this router just a normal host without routing capability. I configured one of the Router's interface with IP address 192.168.1.1 /24. I didn't configure Default Gateway. I enabled packet capture on interface which has IP address. Then I started to ping 8.8.8.8 and I see that Router is sending ARP requests out of that Interface (with IP address configured). I tried to ping many different IP addresses which are not part of interface network 192.168.1.0/24 and all the time Router sends ARP for those destination out of that interface.

Then I did another test. I configured second Interface on Router with IP: 172.16.1.1/24. So, I had 2 interfaces configured with IP addresses. I did the same ping, and every time when I did pings to remote networks, Router was sending ARP only out of one particular interface. So, it doesn't send ARP requests (for the same destination) in parallel out of all active interfaces, also it doesn't try to send ARP our of another interface, if there is no ARP reply for the first interface. It looks like, if there are multiple interfaces, Cisco IOS choose one interface to send ARP out of it, if no default gateway is configured, and packets needs to be send to non-connected network. Then I disabled that interface and ping again, this time Router started to send ARP requests out of another interface. After I enabled first interface back, Router started to ARP from it. So, it looks like there is some logic, router picks some interface and uses it to ARP non-connected networks, but if it's down it will ARP anyway, but from another active interface. It's very interesting, which logic CIsco IOS uses to pick interface for ARP non-connected networks (considering that default gateway is not configured).

[Joseph W. Doherty]

It seems you pretty much confirmed what I wrote (both what I expected, and what might happen).

Again, not an issue I've had to deal with.

It's possible RFCs don't address multi-homed hosts without gateways correct/expected behavior, or if they do, they might have "may" rather than "shall", or a vendor's particular implementation may be buggy or it doesn't (intentionally) conform to RFCs.

Whatever the actual case, whatever you discover, I would be careful considering it will always be done that way on other devices.  (This because, not something many will use or rely upon for real-world operations.)

[NetworkingGeek1]

@Joseph W. Doherty  thanks for the reply. Basically, I just wanted to check if experts from this forum aware of that behavior of Cisco IOS and maybe can clarify it. But it seems this behavior is not documented, so we can just guess.

"Whatever the actual case, whatever you discover, I would be careful considering it will always be done that way on other devices." - Totally agree with you.

"This because, not something many will use or rely upon for real-world operations" - Can you please explain what do you mean?

"Yes, but if host has a network mask, it will know what's considered on its own network vs. not its own network. (Keep in mind, networks not the host's might still be on/within the same L2 broadcast domain, so for those on the same L2 broadcast domain, ARPing works fine, no proxy router needed, and if proxy router, ARPing works for non host network physically within same L2 broadcast domain, and those "beyond" the proxy router.)" - Can you please explain this? Do you mean that different networks still can be in one L2 broadcast domain? And this part please "and if proxy router, ARPing works for non host network physically within same L2 broadcast domain, and those "beyond" the proxy router."

[Joseph W. Doherty · Accepted solution]

"This because, not something many will use or rely upon for real-world operations" - Can you please explain what do you mean?

Suppose your testing shows interface with lowest IP or lowest device port-number is always chosen first.  Okay, so in a production environment you insure your device's ports are setup such that your ports are used in the sequence you intend.  But then, you upgrade the IOS or you replace the device with a different model, and the order of operation you've "discovered" is now different, but again, for some reason, you desired that order of operation.  (I.e. you've set yourself up for "broken" operation by doing something that doesn't conform to any standard.  [Laugh - we have enough problems dealing with "bugs" trying to conform to standards.])

"Yes, but if host has a network mask, it will know what's considered on its own network vs. not its own network. (Keep in mind, networks not the host's might still be on/within the same L2 broadcast domain, so for those on the same L2 broadcast domain, ARPing works fine, no proxy router needed, and if proxy router, ARPing works for non host network physically within same L2 broadcast domain, and those "beyond" the proxy router.)" - Can you please explain this?

Do you mean that different networks still can be in one L2 broadcast domain?

Yep, correct.

And this part please "and if proxy router, ARPing works for non host network physically within same L2 broadcast domain, and those "beyond" the proxy router."

To your host, all other hosts are reached by ARPing for their destination IPs.  I don't believe your host can distinguish between another host, in another network, that's actually in your L2 broadcast domain, or one that's "behind" a proxy (router).  (Actually there are some indications whether the other host is physically within the same L2 domain, or not.  For example, if lots of different hosts, in different networks, all have the same MAC, that would likely imply that MAC is a proxy.  Or, if there was some way to contact another host using a broadcast, likely it's not behind a proxy.)

[NetworkingGeek1]

@Joseph W. Doherty  Honestly, I don't think there is any valid reason to put different network in one L2 broadcast domain. Is there any valid reason for that?

[Joseph W. Doherty]

" Honestly, I don't think there is any valid reason to put different network in one L2 broadcast domain. Is there any valid reason for that?"

Honestly, there is a valid reason.  ; )

Normally it's not done, except in the case of transitioning from one network prefix to another, e.g. moving a /27 to a /26 (or larger).

Multiple networks in the same L2 domain would be dealt with, on the same interface, by using secondary addressing.

[mlund]

Interesting test indeed. One common thing when choosing between 2 or more values is, if it is Layer2 then pick the lowest one, if it is Layer3 pick the highest one. So you can try swapping the ports to see if it is the lower portnumber, or you can try to swap the ip addresses to see if it is the higher ip address that is choosen.

[NetworkingGeek1]

@mlund  Thank you for reply. And really appreciated that you liked my test.

I did already port swapping. Initially I configured ports Gig0/0 & Gig0/1 and Router was always picking Gig0/0 and I also thought that it will always pick the lowest number. Then I configured Gig0/2 and disabled Gig0/0. And Router started to send ARPs out of Gig0/2, not out of the current lowest active port which is Gig0/1. So, it looks like Cisco IOS has different logic. I'll check regarding higher IP address and let you know.