On Thu, Jan 16, 2014 at 2:35 AM, Florian Lohoff <[email protected]> wrote: > > Hi, > > we made some upgrade from 4.1.1 to 4.3.2 tonight and discovery new and > strange ARP behaviour. > > The ASR9k seems to store arbitrary ARP responses in its MAC Address > table. >
We ran into similar trouble when swapping out our router for an ASR9k running 4.2.3. Cisco scrambled a SMU for that release (sorta). From their information it is not entirely arbitrary. Any IP that is routed down that link can have an ARP stored. Our trouble became a bit worse when we removed the route and the ARP was still present; the router was then black-holing traffic by trying to send it via the stale ARP. > I know linux has some bad behaviour concerning ARP (default proxy arp > etc) but still i wouldnt expect a decent networking device polluting > their ARP table with entries for ip address not directly connected > or better - not reachable in any directly connected ip segment. > We thought so to. We opened a case - Cisco DDTS CSCty06696 was the result. Cisco did not agree that this was faulty behavior: they insisted that it was correct. The DDTS and SMU are for an option to disable the ability to learn out of subnet ARPs. Under the interface you can configure "arp learning local" to block out-of-subnet ARPs. > PS: I made some sysctl tweaks on the linux machine to behave a little > more nice but still i see a bug here. > We did the same while waiting for the SMU. The SMU should not be needed for 4.3.2 - the "arp learning local" interface command should be built-in, so hopefully you are good to go. Our biggest concern over this incident was receiving malicious ARPs on transit and peering links that have routes to large swaths of the network. If the route goes away, the ARP will be retained for long periods and the router will black-hole traffic until that clears. Cisco PSIRT evaluated the concern but evaluated it as a fairly concern. > -- > Florian Lohoff [email protected] Best Regards, Andrew Koch _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
