Additional Features to Support Multi-VRF
Static ARP
Static ARP entries help ensure Layer 2 to Layer 3 mappings. This removes some network overhead in the form of ARP requests and replies and can be helpful in managing Multi-VRF networks where devices must communicate on a regular basis. The interface associated with an ARP entry determines which VRF the ARP entry belongs to. However, the additional management involved in adding and maintaining static ARP cache entries must also be taken into account.
An ARP entry is defined by the following parameters:
The
arp command is used to configure static ARP entries on a nondefault VRF interface. (An
ARP index is not required before a static ARP is configured.) The
arp command is available in the address-family mode for a particular VRF.
Proxy ARP
Proxy ARP allows a Layer 3 switch to answer ARP requests from devices on one subnet on behalf of devices in another network. Proxy ARP is configured globally and can be further configured per interface. Interface-level configuration overrides the global configuration.
With the
proxy-arp command configured, a router does not respond to ARP requests for IP addresses in
the same subnet as the incoming ports. The
local-proxy-arp command permits the router to respond to ARP requests for IP addresses within the
same subnet and to forward all traffic between hosts in the subnet. The
local-proxy-arp command is an interface-level configuration that has no VRF-related impact.
ARP Rate Limiting
ARP rate limiting is configured globally and applies to all VRFs.
ARP age can be configured globally and on a Layer 3 interface. An ARP age timer configured on a Layer 3 interface overrides the global configuration for ARP aging. The aging timer ensures that the ARP cache does not retain learned entries that are no longer valid.
Dynamic ARP Inspection
Dynamic ARP Inspection (DAI) enables the RUCKUS device to intercept and examine all ARP request and response packets in a subnet and to discard packets with invalid IP-to-MAC address bindings. DAI can prevent common man-in-the-middle (MiM) attacks such as ARP cache poisoning and can prevent the misconfiguration of client IP addresses. DAI allows only valid ARP requests and responses to be forwarded, and supports Multi-VRFs with overlapping address spaces. For more information on DAI, refer to the RUCKUS FastIron Security Configuration Guide.
DHCP Snooping
Dynamic Host Configuration Protocol (DHCP) snooping enables a RUCKUS device to filter untrusted DHCP IPv4 or IPv6 packets in a subnet. DHCP snooping can ward off MiM attacks, such as a malicious user posing as a DHCP server sending false DHCP server reply packets with the intention of misdirecting other users. DHCP snooping can also stop unauthorized DHCP servers and prevent errors resulting from the user misconfiguration of DHCP servers. DHCP snooping supports Multi-VRFs. For more information on configuring DHCP IPv4 or IPv6 snooping to support a Multi-VRF instance, refer to the RUCKUS FastIron Security Configuration Guide.
IP Source Guard
You can use IP Source Guard (IPSG) together with DAI on untrusted ports. The RUCKUS implementation of the IP Source Guard feature supports configuration on a port, on specific VLAN memberships on a port (for Layer 2 devices only), and on specific ports on a virtual Ethernet (VE) interface (for Layer 3 devices only). For more information on IPSG, refer to the RUCKUS FastIron Security Configuration Guide.