Nexus Gratuitous ARP behaviour with GLBP and Address Conflict Detection (ACD - RFC 5277)

Available Languages

Download Options

PDF (123.9 KB)
View with Adobe Reader on a variety of devices
ePub (105.5 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (116.7 KB)
View on Kindle device or Kindle app on multiple devices

Updated:February 12, 2019

Document ID:214102

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document helps users to understand the behaviour of Address Conflict Detection (ACD - RFC 5277) with GLBP on Cisco Nexus Platforms.

Prerequisite

Cisco recommends that you have basic knowledge of first hop redundancy protocols such as HSRP, VRRP, GLBP, and Virtual port channel (vPC) concept, packet capture tools like ethanalyzer and ELAM on the Cisco Nexus platform.

Components Used

The information in this document is based on the Nexus platform.

The information in this document is created based on a specific internal lab environment. All of the devices used in this document started with a default configuration. If your network is live, ensure that you understand the potential impact of any command to the existing traffic flow.

Topology

Observation

The ACD packets are generated using traffic generator as below

DMAC = ff.ff.ff.ff.ff.ff

SMAC = 00.00.04.00.08.00

SIP = 0.0.0.0

DIP = 11.95.232.123 (VIP)

When IXIA sends ACD packets to the actual SVI IP, the switch responds with a GARP as seen below -

Nexus Switch A# ethanalyzer local interface  inband display-filter "arp" limit-captured-frames 0
Capturing on inband
2018-10-18 07:56:09.422340 Xerox_00:08:00 -> Broadcast    ARP 60 Who has 11.95.232.121?  Tell 0.0.0.0
2018-10-18 07:56:09.424806 Cisco_a6:cb:c1 -> Broadcast    ARP 60 Gratuitous ARP for 11.95.232.121 (Request)
2018-10-18 07:56:09.432365 Xerox_00:08:00 -> Broadcast    ARP 60 Who has 11.95.232.121?  Tell 0.0.0.0
2018-10-18 07:56:09.434743 Cisco_a6:cb:c1 -> Broadcast    ARP 60 Gratuitous ARP for 11.95.232.121 (Request)

But when the same packet is sent with the GLBP VIP, we do not see any response from the switch. The capture on the CPU of the switch seen below -

Nexus Switch A# ethanalyzer local interface  inband display-filter "arp" limit-captured-frames 0
Capturing on inband
2018-10-18 07:56:58.429581 Xerox_00:08:00 -> Broadcast    ARP 60 Who has 11.95.232.123?  Tell 0.0.0.0
2018-10-18 07:56:58.439582 Xerox_00:08:00 -> Broadcast    ARP 60 Who has 11.95.232.123?  Tell 0.0.0.0

Note - ELAM capture (not included here) on Nexus shows source index as ingress ethernet interface which is the interface through which packet entered the switch. However, destination index points to drop index.

Similar tests performed on other FHRP protocols like HSRP and VRRP show that the switch responds to ACD packet sent with VIP IP address.

GARP response seen with HSRP configuration with VIP:11.95.232.123

Nexus Switch A# ethanalyzer local interface inband display-filter "arp" limit-captured-frames 0
Capturing on inband
2018-10-18 08:56:09.596212 Xerox_00:08:00 -> Broadcast    ARP 60 Who has 11.95.232.123?  Tell 0.0.0.0
2018-10-18 08:56:09.598593 All-HSRP-routers_01 -> Broadcast    ARP 60 Gratuitous ARP for 11.95.232.123 (Request)
2018-10-18 08:56:09.606203 Xerox_00:08:00 -> Broadcast    ARP 60 Who has 11.95.232.123?  Tell 0.0.0.0
2018-10-18 08:56:09.608652 All-HSRP-routers_01 -> Broadcast    ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

GARP response seen with VRRP configuration with VIP:11.95.232.123

Nexus Switch A# ethanalyzer local  interface inband display-filter "arp" limit-captured-frames 0
Capturing on inband
2018-10-18 09:03:30.225724 Xerox_00:08:00 -> Broadcast    ARP 60 Who has 11.95.232.123?  Tell 0.0.0.0
2018-10-18 09:03:30.228251 IETF-VRRP-VRID_01 -> Broadcast    ARP 60 Gratuitous ARP for 11.95.232.123 (Request)
2018-10-18 09:03:30.235711 Xerox_00:08:00 -> Broadcast    ARP 60 Who has 11.95.232.123?  Tell 0.0.0.0
2018-10-18 09:03:30.238252 IETF-VRRP-VRID_01 -> Broadcast    ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

Conclusion

With GLBP configured, both switches hold the control of the VIP. Due to this GARP is not sent as it would generate duplicate arp in the logs.

Reference

CSCvn03802 Address conflict detection(ACD) doesn't work with GLBP virtual GW.

OBSERVATIONS:

When IXIA sends ACD packet to SVI VIP. GARP response was seen.

N7K-C7010-1# ethanalyzer local interface inband display-filter "arp" limit-captured-frames 0

Capturing on inband

2018-10-18 07:56:09.422340 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.121? Tell 0.0.0.0

2018-10-18 07:56:09.424806 Cisco_a6:cb:c1 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.121 (Request)

2018-10-18 07:56:09.432365 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.121? Tell 0.0.0.0

2018-10-18 07:56:09.434743 Cisco_a6:cb:c1 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.121 (Request)

2018-10-18 07:56:09.442287 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.121? Tell 0.0.0.0

2018-10-18 07:56:09.444740 Cisco_a6:cb:c1 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.121 (Request)

No response was seen when sent to GLBP VIP.

N7K-C7010-1# ethanalyzer local interface inband display-filter "arp" limit-captured-frames 0

Capturing on inband

2018-10-18 07:56:58.429581 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 07:56:58.439582 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 07:56:58.449502 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 07:56:58.459502 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 07:56:58.469500 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 07:56:58.479461 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

ELAM showed source index as ethernet1/5 which is the interface through which packet entered. However, destination index pointed towards interface ethernet2/23 which we assume the switch is using to drop the packet.

GARP response seen with HSRP configuration with VIP :11.95.232.123

N7K-C7010-1(config-if)# ethanalyzer local interface inband display-filter "arp" limit-captured-frames 0

Capturing on inband

2018-10-18 08:56:09.596212 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 08:56:09.598593 All-HSRP-routers_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 08:56:09.606203 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 08:56:09.608652 All-HSRP-routers_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 08:56:09.616204 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 08:56:09.618657 All-HSRP-routers_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 08:56:09.626203 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 08:56:09.628657 All-HSRP-routers_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 08:56:09.636205 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 08:56:09.638564 All-HSRP-routers_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 08:56:09.646249 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 08:56:09.648541 All-HSRP-routers_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 8:56:09.656205 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

GARP response seen with VRRP configuration with VIP:11.95.232.123

N7K-C7010-1(config-if)# ethanalyzer local interface inband display-filter "arp" limit-captured-frames 0

Capturing on inband

2018-10-18 09:03:30.225724 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 09:03:30.228251 IETF-VRRP-VRID_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 09:03:30.235711 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 09:03:30.238252 IETF-VRRP-VRID_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 09:03:30.245710 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 09:03:30.248253 IETF-VRRP-VRID_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 09:03:30.255709 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 09:03:30.258248 IETF-VRRP-VRID_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 09:03:30.265708 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 09:03:30.268255 IETF-VRRP-VRID_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 09:03:30.275710 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 09:03:30.278259 IETF-VRRP-VRID_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

2018-10-18 09:03:30.285709 Xerox_00:08:00 -> Broadcast ARP 60 Who has 11.95.232.123? Tell 0.0.0.0

2018-10-18 09:03:30.288296 IETF-VRRP-VRID_01 -> Broadcast ARP 60 Gratuitous ARP for 11.95.232.123 (Request)

Reason:

=======

With GLBP both devices hold the control of VIP. Due to this we can not let the GARP work as it will keep giving usthe duplicat Arp logs as both will hold the ip.

We have opened a DOc bug CSCvn03802 , to get this listed in the CCO doc.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/nx-os/unicast/configuration/guide/b-7k-Cisco-Nexus-7000-Series-NX-OS-Unicast-Routing-Configuration-Guide-Release/n7k_unicast_config_glbp.html#concept_FE1CBD0F54A14417ADD9DA2DC2312900

"The GLBP does not support gratuitous ARP by design"

Regards,

Lovkesh

OBSERVATIONS:

=============