Example: Configuring Unrestricted Proxy ARP on an EX Series Switch
You can configure unrestricted proxy ARP on your switch to increase security by forcing hosts to send and receive communications through the switch rather than exchange communications directly.
This example shows how to configure unrestricted proxy ARP on an access switch:
Requirements
This example uses the following hardware and software components:
- JUNOS Release 9.6 or later for EX Series switches
- One EX Series switch
Before you set up unrestricted proxy ARP, ensure that you have:
- Configured the EX Series switch with two VLANs. See Example: Setting Up Bridging with Multiple VLANs for EX Series Switches.
 |
Note: You do not need to configure multiple VLANs to use unrestricted proxy ARP. You can choose to configure unrestricted proxy ARP when only a single VLAN (the default configuration) is being used on the switch. This example, however, uses two VLANs to emphasize the fact that unrestricted proxy ARP applies globally on the switch. Even when two VLANs are configured, setting a single interface within one VLAN to use unrestricted proxy ARP automatically applies that setting to all interfaces within both VLANs on the switch. |
Overview and Topology
When you enable proxy ARP on an EX Series switch, it operates in unrestricted mode. This is the only mode available and this setting applies globally to all interfaces on the switch. Therefore, when proxy ARP is enabled, even hosts within the same VLAN must send and receive communications through the switch.
|
Note: If you enable proxy ARP for one of the interfaces on the switch, this setting applies to all the interfaces on the switch. |
The topology for this example consists of one EX Series switch, which has been configured with two VLANs. One VLAN, called sales, is for the sales and marketing group, and a second, called engineering, is for the engineering development team. The VLANs belong to different subnets.
When a host wants to communicate with another host, it broadcasts an ARP request for the MAC address of the destination host:
- When proxy ARP is not enabled, a host that shares the same IP address replies directly to the ARP request, providing its MAC address, and future transmissions are sent directly to the destination host MAC address.
- When unrestricted proxy ARP is enabled, the switch responds to all ARP requests, providing the switch’s MAC address—even when the destination IP address is the same as the source IP address. Thus, all communications must be sent through the switch and then routed through the switch to the appropriate destination.
This example includes disabling interfaces from responding to gratuitous ARP requests. If you do not disable gratuitous ARP requests, the switch responds to all ARP messages including gratuitous ARP requests. When a switch receives a gratuitous ARP request, it might interpret that as an indication of an IP conflict.
Table 1 shows the components of this topology.
Table 1: Components of the Unrestricted Proxy ARP Switch
|
Note: By default, if you enable proxy ARP, it works in unrestricted mode and applies globally to all the interfaces on the switch. You should disable gratuitous ARP requests on all the interfaces. (Disabling gratuitous ARP is not a global setting.) To keep the example simple, the configuration steps show how to disable gratuitous ARP requests on only a few interfaces in each of the VLANs. Use the same configuration procedure to configure more interfaces. |
Configuration
Configure unrestricted proxy ARP:
CLI Quick Configuration
To quickly configure unrestricted proxy ARP, copy the following commands and paste them into the switch terminal window:
[edit]
set interfaces
ge-0/0/3 unit 0 proxy-arp
set interfaces ge-0/0/3 no-gratuitous-arp-request
set interfaces ge-0/0/4 no-gratuitous-arp-request
set interfaces ge-0/0/5 no-gratuitous-arp-request
set interfaces ge-0/0/25 no-gratuitous-arp-request
set interfaces ge-0/0/26 no-gratuitous-arp-request
set interfaces ge-0/0/27 no-gratuitous-arp-request
Step-by-Step Procedure
Configure one interface for proxy ARP:
- Configure one interface for proxy ARP:
[edit interfaces]
user@switch# set ge-0/0/3 unit 0 proxy-arp - Disable gratuitous ARP on all the interfaces in
the sales VLAN:
[edit interfaces]
user@switch# set ge-0/0/3 no-gratuitous-arp-request
user@switch# set ge-0/0/4 no-gratuitous-arp-request
user@switch# set ge-0/0/5 no-gratuitous-arp-request - Disable gratuitous ARP on all the interfaces in
the engineering VLAN:
[edit interfaces]
user@switch# set ge-0/0/25 no-gratuitous-arp-request
user@switch# set ge-0/0/26 no-gratuitous-arp-request
user@switch# set ge-0/0/27 no-gratuitous-arp-request
Results
Display the results of the configuration:
- user@switch> show configuration
-
- interfaces {
-
- ge-0/0/3 {
- no-gratuitous-arp-request;
-
- unit 0 {
- description sales;
- proxy-arp;
-
- family ethernet-switching {
-
- vlan {
- members sales;
- }
- }
- }
- }
-
- ge-0/0/4 {
- no-gratuitous-arp-request;
-
- unit 0 {
- description sales;
-
- family ethernet-switching {
-
- vlan {
- members sales;
- }
- }
- }
- }
-
- ge-0/0/5 {
- no-gratuitous-arp-request;
-
- unit 0 {
- description sales;
-
- family ethernet-switching {
-
- vlan {
- members sales;
- }
- }
- }
- }
-
- ge-0/0/25 {
- no-gratuitous-arp-request;
-
- unit 0 {
- description engineering;
-
- family ethernet-switching {
-
- vlan {
- members engineering;
- }
- }
- }
- }
-
- ge-0/0/26 {
- no-gratuitous-arp-request;
-
- unit 0 {
- description engineering;
-
- family ethernet-switching {
-
- vlan {
- members engineering;
- }
- }
- }
- }
-
- ge-0/0/27 {
- no-gratuitous-arp-request;
-
- unit 0 {
- description engineering;
-
- family ethernet-switching {
-
- vlan {
- members engineering;
- }
- }
- }
- }
Verification
Verify that the switch is sending proxy ARP messages:
Verifying That the Switch Is Sending Proxy ARP Messages:
Purpose
Verify that the switch is sending proxy ARP messages.
Action
List the system statistics for ARP messages:
user@switch> show system statistics arp arp:
198319 datagrams received
45 ARP requests received
12 ARP replys received
2 resolution requests received
2 unrestricted proxy requests
0 restricted proxy requests
0 received proxy requests
0 proxy requests not proxied
0 restricted-proxy requests not proxied
0 with bogus interface
0 with incorrect length
0 for non-IP protocol
0 with unsupported op code
0 with bad protocol address length
0 with bad hardware address length
0 with multicast source address
0 with multicast target address
0 with my own hardware address
168705 for an address not on the interface
0 with a broadcast source address
0 with source address duplicate to mine
29555 which were not for me
0 packets discarded waiting for resolution
4 packets sent after waiting for resolution
27 ARP requests sent
47 ARP replys sent
0 requests for memory denied
0 requests dropped on entry
0 requests dropped during retry
0 requests dropped due to interface deletion
0 requests on unnumbered interfaces
0 new requests on unnumbered interfaces
0 replies for from unnumbered interfaces
0 requests on unnumbered interface with non-subnetted donor
0 replies from unnumbered interface with non-subnetted donor
Meaning
The statistics show that two unrestricted proxy requests were received and proxy requests not proxied indicates that all the unproxied ARP requests received have been proxied by the switch.
