-
Cisco IOS XE IP Addressing Services Configuration Guide, Release 2
- Part 1: IP Addressing
- Part 2: ARP
-
Part 3: DHCP
-
DHCP Overview
-
Configuring the Cisco IOS XE DHCP Server
-
Configuring the DHCP Server On-Demand Address Pool Manager
-
Configuring the Cisco IOS XE DHCP Relay Agent
-
DHCP Relay Server ID Override and Link Selection Option 82 Suboptions
-
DHCP Server RADIUS Proxy
-
Configuring the Cisco IOS XE DHCP Client
-
Configuring DHCP Services for Accounting and Security
-
ISSU and SSO--DHCP High Availability Features
-
- Part 4: DNS
- Part 5: NAT
- Part 6: NHRP
Table Of Contents
Configuring Address Resolution Protocol Options
Information About Address Resolution Protocol Options
Layer 2 and Layer 3 Addressing
Static and Dynamic Entries in the ARP Cache
Serial Line Address Resolution Protocol
How to Configure Address Resolution Protocol Options
Enabling the Interface Encapsulation
Setting an Expiration Time for Dynamic Entries in the ARP Cache
Disabling Proxy ARP on an Interface
Verifying the ARP Configuration
Configuration Examples for Address Resolution Protocol Options
Static ARP Entry Configuration: Example
Proxy ARP Configuration: Example
Sticky ARP Configuration: Example
Clearing the ARP Cache: Example
Feature Information for Configuring Address Resolution Protocol Options
Configuring Address Resolution Protocol Options
First Published: May 2, 2005Last Updated: May 4, 2009Address Resolution Protocol (ARP) performs a required function in IP routing. ARP finds the hardware address, also known as Media Access Control (MAC) address, of a host from its known IP address. ARP maintains a cache (table) in which MAC addresses are mapped to IP addresses. ARP is part of all Cisco IOS XE systems running IP.
This document explains ARP for IP routing and the optional ARP features you can configure, such as static ARP entries, time out for dynamic ARP entries, clearing the cache, and Proxy ARP.
Finding Feature Information
For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Configuring Address Resolution Protocol Options" section.
Use Cisco Feature Navigator to find information about platform support and Cisco IOS XE software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Information About Address Resolution Protocol Options
•
•
•
Information About Address Resolution Protocol Options
To configure the ARP options, you need to understand the following concepts:
•
•
•
Layer 2 and Layer 3 Addressing
IP addressing occurs at Layer 2 (data link) and Layer 3 (network) of the Open System Interconnection (OSI) reference model. OSI is an architectural network model developed by ISO and ITU-T that consists of seven layers, each of which specifies particular network functions such as addressing, flow control, error control, encapsulation, and reliable message transfer.
Layer 2 addresses are used for local transmissions between devices that are directly connected. Layer 3 addresses are used for indirectly connected devices in an internetwork environment. Each network uses addressing to identify and group devices so that transmissions can be sent and received. Ethernet (802.2, 802.3, Ethernet II, and Subnetwork Access Protocol [SNAP]) use Media Access Control (MAC) addresses that are "burned in" to the Network Interface Card (NIC). The most commonly used network types are Ethernet II and SNAP.
In order for devices to be able to communicate with each when they are not part of the same network, the 48-bit MAC address must be mapped to an IP address. Some of the Layer 3 protocols used to perform the mapping are:
•
•
•
•
For the purposes of IP mapping, Ethernet frames contain the destination and source addresses Frame Relay and Asynchronous Transfer Mode (ATM) networks, which are packet switched, data packets take different routes to reach the same destination. At the receiving end, the packet is reassembled in the correct order.
In a Frame Relay network, there is one physical link that has many logical circuits called virtual circuits (VCs). The address field in the frame contains a data-link connection identifier (DLCI) which identifies each VC. For example, in Figure 1, the Frame Relay switch to which router Fred is connected receives frames; the switch forwards the frames to either Barney or Betty based on the DLCI which identifies each VC. So Fred has one physical connection but multiple logical connections.
Figure 1 Frame Relay Network
ATM networks use point-to-point serial links with the High-Level Data Link Control (HDLC) protocol. HDLC includes a meaningless address field included in five bytes of the frame header frame with the recipient implied since there can only be one.
Address Resolution Protocol
Address Resolution Protocol (ARP) was developed to enable communications on an internetwork and is defined by RFC 826. Routers and Layer 3 switches need ARP to map IP addresses to MAC hardware addresses so that IP packets can be sent across networks. Before a device sends a datagram to another device, it looks in its own ARP cache to see if there is a MAC address and corresponding IP address for the destination device. If there is no entry, the source device sends a broadcast message to every device on the network. Each device compares the IP address to its own. Only the device with the matching IP address replies to the sending device with a packet containing the MAC address for the device. The source device adds the destination device MAC address to its ARP table for future reference, creates a data-link header and trailer that encapsulates the packet, and proceeds to transfer the data. Figure 2 illustrates the ARP broadcast and response process.
Figure 2 ARP Process
When the destination device lies on a remote network, one beyond another router, the process is the same except that the sending device sends an ARP request for the MAC address of the default gateway. After the address is resolved and the default gateway receives the packet, the default gateway broadcasts the destination IP address over the networks connected to it. The router on the destination device network uses ARP to obtain the MAC address of the destination device and delivers the packet.
Encapsulation of IP datagrams and ARP requests and replies on IEEE 802 networks other than Ethernet use Subnetwork Access Protocol (SNAP).
The ARP request message has the following fields:
•
•
•
–
–
–
•
•
•
•
ARP Caching
Because the mapping of IP addresses to MAC addresses occurs at each hop (router) on the network for every datagram sent over an internetwork, performance of the network could be compromised. To minimize broadcasts and limit wasteful use of network resources, ARP caching was implemented.
ARP caching is the method of storing network addresses and the associated data-link addresses in memory for a period of time as the addresses are learned. This minimizes the use of valuable network resources to broadcast for the same address each time a datagram is sent. The cache entries must be maintained because the information could become outdated, so it is critical that the cache entries are set to expire periodically. Every device on a network updates its tables as addresses are broadcast.
There are static ARP cache entries and dynamic ARP cache entries. Static entries are manually configured and kept in the cache table on a permanent basis. They are best for devices that have to communicate with other devices usually in the same network on a regular basis. Dynamic entries are added by the Cisco IOS XE software and kept for a period of time, then removed.
Static and Dynamic Entries in the ARP Cache
Static routing requires an administrator to manually enter IP addresses, subnet masks, gateways, and corresponding MAC addresses for each interface of each router into a table. Static routing enables more control but requires more work to maintain the table. The table must be updated each time routes are added or changed.
Dynamic routing uses protocols that enable the routers in a network to exchange routing table information with each other. The table is built and changed automatically. No administrative tasks are needed unless a time limit is added, so dynamic routing is more efficient than static routing. The default time limit is 4 hours.If the network has a great many routes that are added and deleted from the cache, the time limit should be adjusted.
The routing protocols that dynamic routing uses to learn routes, such as distance-vector and link-state, is beyond the scope of this document. For more information, refer to Cisco IOS XE IP Routing Protocols Configuration Guide.
Devices That Do Not Use ARP
When a network is divided into two segments, a bridge joins the segments and filters traffic to each segment based on MAC addresses. The bridge builds its own address table, which uses MAC addresses only, as opposed to a router, which has a ARP cache that contains both IP addresses and the corresponding MAC addresses.
Passive hubs are central-connection devices that physically connect other devices in a network. They send messages out all of their ports to the devices and operate at Layer 1, but do not maintain an address table.
Layer 2 switches determine which port is connected to a device to which the message is addressed and send only to that port, unlike a hub, which sends the message out all its ports. However, Layer 3 switches are routers that build an ARP cache (table).
Inverse ARP
Inverse ARP, which is enabled by default in ATM networks, builds an ATM map entry and is necessary to send unicast packets to a server (or relay agent) on the other end of a connection. Inverse ARP is only supported for the aal5snap encapsulation type.
For multipoint interfaces, an IP address can be acquired using other encapsulation types because broadcast packets are used. However, unicast packets to the other end will fail because there is no ATM map entry and thus DHCP renewals and releases also fail.
For more information about Inverse ARP and ATM networks, refer to the "Configuring ATM" chapter of the Cisco IOS XE Wide-Area Networking Configuration Guide.
Reverse ARP
Reverse ARP (RARP) as defined by RFC 903 works the same way as ARP, except that the RARP request packet requests an IP address instead of a MAC address. RARP often is used by diskless workstations because this type of device has no way to store IP addresses to use when they boot. The only address that is known is the MAC address because it is burned into the hardware.
Use of RARP requires an RARP server on the same network segment as the router interface. Figure 3 illustrates how RARP works.
Figure 3 RARP Process
There are several limitations of RARP. Because of these limitations, most businesses use DHCP to assign IP addresses dynamically. DHCP is cost effective and requires less maintenance than RARP. The most important limitations are as follows:
•
•
•
The Cisco IOS XE software attempts to use RARP if it does not know the IP address of an interface at startup to respond to RARP requests that they are able to answer. A feature of Cisco IOS XE software automates the configuration of Cisco devices and is called AutoInstall.
AutoInstall supports RARP and enables a network manager to connect a new router to a network, turn it on, and load a pre-existing configuration file automatically. The process begins when no valid configuration file is found in NVRAM. For more information about AutoInstall, refer to the Cisco IOS XE Configuration Fundamentals Configuration Guide.
Proxy ARP
Proxy ARP, as defined in RFC 1027, was implemented to enable devices that are separated into physical network segments connected by a router in the same IP network or subnetwork to resolve the IP-to-MAC addresses. When devices are not in the same data link layer network but in the same IP network, they try to transmit data to each other as if they are on the local network. However, the router that separates the devices will not send a broadcast message because routers do not pass hardware-layer broadcasts. The addresses cannot be resolved.
Proxy ARP is enabled by default so the "proxy router" that resides between the local networks will respond with its MAC address as if it is the router to which the broadcast is addressed. When the sending device receives the MAC address of the proxy router, it sends the datagram to the proxy router that in turns sends the datagram to the designated device.
Proxy ARP is invoked by the following conditions:
•
•
•
When proxy ARP is disabled, a device will respond to ARP requests received on its interface only if the target IP address is the same as its IP address, or the target IP address in the ARP request has a statically configured ARP alias.
Serial Line Address Resolution Protocol
Serial Line ARP (SLARP) is used for serial interfaces that use High-Level Data Link Control (HDLC) encapsulation. A SLARP server, intermediate (staging) router, and another router providing a SLARP service may be required in addition to a TFTP server. If an interface is not directly connected to a server, the staging router is required to forward the address resolution requests to the server, otherwise a directly connected router with SLARP service is required. The Cisco IOS XE software attempts to use SLARP if it does not know the IP address of an interface at startup to respond to SLARP requests that software is able to answer.
A feature of Cisco IOS XE software automates the configuration of Cisco devices and is called AutoInstall. AutoInstall supports SLARP and enables a network manager to connect a new router to a network, turn it on, and load a pre-existing configuration file automatically. The process begins when no valid configuration file is found in NVRAM. For more information about AutoInstall, refer to the Cisco IOS XE Configuration Fundamentals Configuration Guide.
Note
How to Configure Address Resolution Protocol Options
ARP is enabled by default and is set to use Ethernet encapsulation by default. Perform the following tasks to change or verify ARP functionality:
•
•
•
•
•
•
•
•
Enabling the Interface Encapsulation
Perform this task to support a type of encapsulation for a specific network, such as Ethernet or Frame Relay. When Frame Relay encapsulation is specified, the interface is configured for a Frame Relay subnetwork in which there is one physical link that has many logical circuits called virtual circuits (VCs). The address field in the frame contains a data-link connection identifier (DLCI) which identifies each VC. When SNAP encapsulation is specified, the interface is configured for FDDI or Token Ring networks.
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Defining Static ARP Entries
Perform this task to define static mapping between IP addresses (32-bit address) and a MAC address (48-bit address) for hosts that do not support dynamic ARP. Because most hosts support dynamic address resolution, defining static ARP cache entries is usually not required. Performing this task installs a permanent entry in the ARP cache that never times out. The entries remain in the ARP table until they are removed using the no arp command or the clear arp interface command for each interface.
Note
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Setting an Expiration Time for Dynamic Entries in the ARP Cache
Perform this task to set a time limit for dynamic entries in the ARP cache.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Globally Disabling Proxy ARP
Proxy ARP is enabled by default; perform this task to globally disable proxy ARP on all interfaces.
The Cisco IOS XE software uses proxy ARP (as defined in RFC 1027) to help hosts with no knowledge of routing determine the MAC addresses of hosts on other networks or subnets. For example, if hosts A and B are on different physical networks, host B will not receive the ARP broadcast request from host A and cannot respond to it. However, if the physical network of host A is connected by a gateway to the physical network of host B, the gateway will see the ARP request from host A.
Assuming that subnet numbers were assigned to correspond to physical networks, the gateway can also tell that the request is for a host that is on a different physical network. The gateway can then respond for host B, saying that the network address for host B is that of the gateway itself. Host A will see this reply, cache it, and send future IP packets for host B to the gateway.
The gateway will forward such packets to host B by using the configured IP routing protocols. The gateway is also referred to as a transparent subnet gateway or ARP subnet gateway.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Disabling Proxy ARP on an Interface
Proxy ARP is enabled by default; perform this task to disable proxy ARP on an interface.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Configuring Sticky ARP
Sticky ARP prevents MAC address spoofing by ensuring that ARP entries (IP address, MAC address, and source VLAN) do not get overridden. The router maintains ARP entries in order to forward traffic to end devices or other routers. ARP entries are usually updated periodically or modified when ARP broadcasts are received. During an attack, ARP broadcasts are sent using a spoofed MAC address (with a legitimate IP address) so that the router learns the legitimate IP address with the spoofed MAC address and begins to forward traffic to that MAC address. With sticky ARP enabled, the router learns the ARP entries and does not accept modifications received through ARP broadcasts. If you attempt to override the sticky ARP configuration, you will receive an error message.
Perform this task to configure sticky ARP on an interface.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Clearing the ARP Cache
Perform the following tasks to clear the ARP cache of entries associated with an interface and to clear all dynamic entries from the ARP cache, the fast-switching cache, and the IP route cache.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Verifying the ARP Configuration
To verify the ARP configuration, perform the following steps.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Step 1
To display the type of ARP being used on a particular interface and also display the ARP timeout value, use the show interfaces EXEC command.
Router# show interfaces GigabitEthernet0/0/0GigabitEthernet0/0/0 is up, line protocol is up Hardware is SPA-8X1GE-V2, address is 001a.3045.4100 (bia 001a.3045.4100) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive not supported Full Duplex, 1000Mbps, link type is auto, media type is SX output flow-control is off, input flow-control is off ARP type: ARPA, ARP Timeout 04:00:00 Last input never, output 00:00:50, output hang never Last clearing of ''show interface'' counters never Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 7998 packets output, 3074275 bytes, 0 underruns 0 output errors, 0 collisions, 4 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped outStep 2
Use the show arp EXEC command to examine the contents of the ARP cache.
Router# show arpProtocol Address Age (min) Hardware Addr Type InterfaceInternet 10.1.1.1 43 001b.53e1.7201 ARPA GigabitEthernet0/0/6Internet 10.1.1.2 29 0021.d8ab.0b00 ARPA GigabitEthernet0/0/6Internet 10.1.2.1 80 001a.3045.4107 ARPA GigabitEthernet0/0/7Internet 10.1.2.1 - 0000.0c02.a03c ARPA GigabitEthernet0/0/7Step 3
Use the show ip arp EXEC command to show IP entries. To remove all nonstatic entries from the ARP cache, use the clear arp-cache privileged EXEC command.
Router# show ip arpProtocol Address Age (min) Hardware Addr Type InterfaceInternet 10.1.1.1 43 001b.53e1.7201 ARPA GigabitEthernet0/0/6Internet 10.1.1.2 29 0021.d8ab.0b00 ARPA GigabitEthernet0/0/6Internet 10.1.2.1 80 001a.3045.4107 ARPA GigabitEthernet0/0/7Internet 10.1.2.1 - 0000.0c02.a03c ARPA GigabitEthernet0/0/7Step 4
Use the show processes cpu | include (ARP | PID) command to display ARP and RARP processes.
Router# show processes cpu | include (ARP | PID)PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process9 46 515 89 0.00% 0.00% 0.00% 0 ARP Input10 7 19078 0 0.00% 0.00% 0.00% 0 ARP Background110 1 2 500 0.00% 0.00% 0.00% 0 IP ARP Adjacency136 0 7 0 0.00% 0.00% 0.00% 0 ARP HA182 0 8 0 0.00% 0.00% 0.00% 0 RARP InputConfiguration Examples for Address Resolution Protocol Options
This section provides the following configuration examples:
•
•
•
•
Static ARP Entry Configuration: Example
The following example shows how to configure a static ARP entry in the cache and by using the alias keyword, Cisco IOS XE software can respond to ARP requests as if it were the interface of the specified address:
arp 10.0.0.0 aabb.cc03.8200 aliasinterface GigabitEthernet0/0/0Proxy ARP Configuration: Example
The following example shows how to configure proxy ARP because it was disabled for Gigabit Ethernet interface 0/0/0:
interface GigabitEthernet 0/0/0ip proxy-arpSticky ARP Configuration: Example
The following example shows how to enable sticky ARP on Gigbit Ethernet interface 0/0/0:
interface GigabitEthernet0/0/0ip sticky-arpClearing the ARP Cache: Example
The following example shows how to clear all of the entries in the ARP cache associated with an interface:
Router# clear arp interface GigabitEthernet0/0/0The following example shows how to clear all of the dynamic entries in the ARP cache:
Router# clear arp-cacheAdditional References
The following sections provide references related to configuring Address Resolution Protocol Options.
Related Documents
ARP commands: complete command syntax, command mode, command history, defaults, usage guidelines, and examples
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
Technical Assistance
Feature Information for Configuring Address Resolution Protocol Options
Table 1 lists the features in this module and provides links to specific configuration information.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS XE software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Table 1 Feature Information for Configuring Address Resolution Protocol Options
ARP
Cisco IOS XE
Release 2.1Address Resolution Protocol (ARP) performs a required function in IP routing. ARP finds the hardware address, also known as Media Access Control (MAC) address, of a host from its known IP address. ARP maintains a cache (table) in which MAC addresses are mapped to IP addresses. ARP is part of all Cisco IOS XE systems running IP.
ARP Optimization
Cisco IOS XE
Release 2.1Previously, the ARP table was organized for easy searching on an entry based on the IP address. However, there are cases such as interface flapping on the router and a topology change in the network where all related ARP entries need to be refreshed for correct forwarding. This situation could consume a substantial amount of CPU time in the ARP process to search and clean up all the entries. The ARP Optimization feature improves ARP performance by reducing the ARP searching time by using an improved data structure.
The following sections provides information about this feature:
•
The following command was introduced by this feature:
clear arp interfacePer Interface Sticky ARP
Cisco IOS XE
Release 2.1Sticky ARP prevents MAC address spoofing by ensuring that ARP entries (IP address, MAC address, and source VLAN) do not get overridden.
The following sections provides information about this feature:
•
The following command was introduced by this feature:
ip sticky-arp
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2007-2009 Cisco Systems, Inc. All rights reserved.
