IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases
IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases
Explains how four ARP controls preserve entries, expire stale mappings, limit cache growth, and police duplicates and provides procedures for configuring and verifying each control.
Address Resolution Protocol (ARP) cache management uses controls that
preserve dynamic entries during short interface flaps and expire stale entries
limit dynamic entries on each interface to protect cache resources, and
police duplicate requests from the same IP address or MAC address.
An ARP purge delay is an interface recovery control that
caches existing dynamic ARP entries when an interface goes down
restores cached entries when the interface returns before the purge timer expires, and
deletes cached entries when the purge timer expires before the interface returns.
The system temporarily reduces the normal entry timeout after the interface state changes.
The reduced timeout starts new ARP resolution after the interface state stabilizes.
Equal-cost multipath (ECMP) sends traffic across paths that have equal cost.
A short interface flap can move traffic to another path and then return it to the restored path.
The purge delay preserves entries until ARP resolution and adjacency installation resume forwarding.
Configure a purge delay to preserve dynamic ARP entries during a short interface flap.
This example configures a 100-second purge delay on interface HundredGigE 0/0/0/34.
Identify the interface and select a purge-delay value.
Follow these steps to configure the ARP purge delay.
The interface retains dynamic ARP entries for up to 100 seconds after it goes down.
An ARP timeout is an entry-aging control that
applies to dynamic entries that the system learns from valid ARP replies
removes stale dynamic entries every four hours by default, and
does not expire local-interface entries or statically configured entries.
Configure how long dynamic ARP entries remain in the cache before they expire.
This example configures a 100-second timeout on interface HundredGigE 0/0/0/35.
Identify the interface and select a timeout value.
Follow these steps to configure the ARP timeout.
Dynamic ARP entries on the interface expire after 100 seconds.
An Address Resolution Protocol (ARP) cache entry limit is an overflow-protection control that
sets the maximum number of dynamic ARP entries that an interface can learn
prevents cache entries from consuming excessive router memory, and
drops new requests after the cache reaches the configured limit.
|
Feature Name |
Release Information |
Feature Description |
|---|---|---|
|
Limit Address Resolution Protocol (ARP) Cache Entries per Interface |
Release 25.4.1 |
Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*) This feature is supported on:
|
|
Limit Address Resolution Protocol (ARP) Cache Entries per Interface |
Release 25.1.1 |
Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*) This feature is supported on:
|
|
Limit Address Resolution Protocol (ARP) Cache Entries per Interface |
Release 24.4.1 |
Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*) *This feature is supported on:
|
|
Limit Address Resolution Protocol (ARP) Cache Entries per Interface |
Release 7.5.4 |
In this feature, you can configure the maximum limit for the number of entries of dynamic mapping between IP addresses and media addresses by ARP per interface. Limiting the number of entries provides overflow protections in ARP cache and protects the routers from DOS attacks by preventing memory overuse by cache entries. This feature introduces the arp cache-limit command. |
You can configure a value from 0 to 127,999 on each interface.
The maximum cache capacity is 127,999 entries.
Available ARP cache resources depend on router hardware. Select a limit that fits the available resources.
The cache limit has these effects:
The router drops new ARP requests when the cache reaches or exceeds the configured limit.
The router stops learning from ARP packets after the cache exceeds the configured limit.
The limit does not apply to static ARP entries.
The router does not enforce the limit on entries that an ARP client triggers.
The router retains dynamic entries that it learned before a lower limit was configured.
The router generates a syslog message when the cache reaches the limit.
The router generates another syslog message for every 1,000 entries beyond the limit.
The show arp idb command displays ARP entry statistics.
Limit dynamic Address Resolution Protocol (ARP) entries to protect the interface cache from overflow and memory overuse.
This example sets the cache limit to 3900 on interface HundredGigE 0/0/0/0.
Select a value from 0 to 127999 that fits the available router resources.
Follow these steps to limit ARP cache entries per interface.
An ARP duplicate policer is a request-control mechanism that
checks requests from the same sender IP address within the configured interval
drops a new request when a response already exists for that IP address, and
checks the MAC-address policer when no response exists for that IP address.
The router drops ARP requests from the same IP address or MAC address during the configured interval.
Set an interval for policing duplicate Address Resolution Protocol (ARP) packets from the same IP address or MAC address.
This example sets the global ARP policing interval to 34.
Router# configure
Router(config)# arp police-interval 34
Router(config)# commit