Best practice on Proxy arp

[musthafa786]

What is best practice on Proxy arp in Layer 3 or SVI interface level ? Thanks.

vlan xx

ip address x.x.x.x

no ip proxy arp  ( by default it is enabled)

Regards,

Musthafa

[Peter Paluch]

Hello Mohammed,

My personal recommendation is to deactivate it unless you precisely know that you need it. Correctly implemented and configured IP stacks never resort to ProxyARP to reach indirect destinations. Instead, they use the configured IP address of their gateway to resolve the L2 address of the next hop. In other words, the ProxyARP is mostly unused.

Best regards,

Peter

[musthafa786]

Thanks Peter,

I have the situation like, if below is my network stettings in my PC I am able to ping different network for eg 20.20.20.100/24

My PC network settings:

IP :10.10.10.100

Subnet mask:255.255.255.0

Default gateway:10.10.10.100 ( hsrp ip in distirbution is 10.10.10.1 - actual gateway)

when I disabled proxy arp in vlan interface 10 ,that means no ip proxy arp under interface vlan ( in both active and standby router) , it doesn't ping network 20.20.20.100 (remote PC)

I dont think giving same ip for default gateway is right approach, but for me this is first experience.

have anbody noticed this ? 

Regards,

Musthafa

[Peter Paluch]

Hi Musthafa,

Do I read you correctly here that you have configured your PC as its own gateway?

Best regards,

Peter

[musthafa786]

Yes Peter , PC as its own gateway.

Regards,

Musthafa

[Peter Paluch]

Hello Musthafa,

Yes Peter , PC as its own gateway.

In that case, it is an incorrect configuration of the IP stack on your PC. No device can use itself as the gateway to reach a station (aside from itself). Clearly, if the operating system blindly obeyed what you configured it to do, it would cause each packet to loop back to the PC, in fact never leaving the computer.

Windows OS obviously tries to gracefully work around this configuration error by resorting to ProxyARP. However, as this configuration is in fact invalid, it should never occur on correctly configured devices.

The bottom line is - if you configure your PCs correctly, you never need ProxyARP.

Best regards,

Peter

[musthafa786]

Yes peter, giving PC ip itself as gateway is incorrect , but I was able to ping another network with pc ip itself as gateway.

I think, in this case packet is hitting gateway ( vlan interface)  as arp request is broadcast and getting reply as proxy arp enabled in interface vlan. If I disable proxy arp( no ip proxy arp under interface vlan), then I cant ping.

Regards,

Musthafa