Documentation
VyOS Documentation
Routing in VyOS
ARP - Address Resolution Protocol

ARP - Address Resolution Protocol

The Address Resolution Protocol (ARP) is a network-layer protocol used to map IP addresses (IPv4) to MAC addresses (hardware addresses) within local Ethernet networks.

Overview

ARP is a critically important protocol for the operation of IPv4 networks:

  • Mapping IP addresses to MAC addresses
  • Caching mappings to reduce network traffic
  • Dynamically updating the ARP table
  • Support for static entries for critical infrastructure
  • Proxy ARP for inter-network communication

Core ARP functions:

  • Address resolution within the local network
  • Maintaining the ARP cache
  • Processing ARP requests and replies
  • Providing connectivity at the link layer

For IPv6, the Neighbor Discovery Protocol (NDP) is used, which is part of ICMPv6.

How ARP works

  1. ARP Request: A host sends a broadcast query “Who has IP X?”
  2. ARP Reply: The node with IP X responds with its MAC address
  3. Caching: Both nodes store the IP-to-MAC mapping in their ARP table
  4. Timeout: Entries age out and are removed after a set time (by default ~60 seconds)

Types of ARP entries

Dynamic ARP:

  • Created automatically during the exchange of ARP requests/replies
  • Have a limited lifetime (TTL)
  • Refreshed when used
  • Removed when they expire

Static ARP:

  • Created manually by the administrator
  • Do not expire automatically
  • Used for critical nodes
  • Protection against ARP spoofing
  • Marked with the “CM” flag (Complete, Manual)

Static ARP entries

Static ARP entries are used to permanently bind an IP address to a MAC address without automatic expiration.

Basic configuration

Creating a static ARP entry:

set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01
commit

Syntax:

set protocols static arp interface <interface> address <IP> mac <MAC>

Parameters:

  • interface - the network interface (eth0, eth1, bond0, etc.)
  • address - the node’s IPv4 address
  • mac - the MAC address in XX:XX:XX:XX:XX:XX format

Multiple static entries

set protocols static arp interface eth0 address 192.168.1.10 mac 00:11:22:33:44:55
set protocols static arp interface eth0 address 192.168.1.20 mac 00:11:22:33:44:66
set protocols static arp interface eth0 address 192.168.1.30 mac 00:11:22:33:44:77
commit

Static ARP for different interfaces

set protocols static arp interface eth0 address 192.168.1.1 mac aa:bb:cc:dd:ee:01
set protocols static arp interface eth1 address 10.0.0.1 mac aa:bb:cc:dd:ee:02
set protocols static arp interface eth2 address 172.16.0.1 mac aa:bb:cc:dd:ee:03
commit

Removing a static entry

delete protocols static arp interface eth0 address 192.168.1.10
commit

Viewing the ARP table

Show all ARP entries

show arp

Example output:

Address                  HWtype  HWaddress           Flags Mask     Iface
10.1.1.1                 ether   00:53:00:de:23:2e   C              eth1
10.1.1.100               ether   00:53:00:de:23:aa   CM             eth1
192.168.1.1              ether   52:54:00:12:34:56   C              eth0
192.168.1.10                     (incomplete)                       eth0

Flag meanings:

  • C (Complete) - the entry is complete and valid
  • M (Manual/Permanent) - a static entry
  • P (Published) - a proxy ARP entry
  • (incomplete) - address resolution has not completed

Show static ARP entries

show protocols static arp

Displays only the statically configured ARP entries:

Address                  HWtype  HWaddress           Flags Mask     Iface
10.1.1.100               ether   00:53:00:de:23:aa   CM             eth1
192.168.1.10             ether   00:11:22:33:44:55   CM             eth0

Show ARP for a specific interface

show protocols static arp interface eth1

Output for the specified interface only:

Address                  HWtype  HWaddress           Flags Mask     Iface
10.1.1.100               ether   00:53:00:de:23:aa   CM             eth1

Operational commands

Show ARP statistics:

show interfaces ethernet eth0 statistics

Clear the dynamic ARP cache (requires operational mode):

reset arp cache

Clear ARP for a specific address:

reset arp cache address 192.168.1.10

Proxy ARP

Proxy ARP allows the router to reply to ARP requests on behalf of other nodes that reside in a different subnet or are not directly reachable.

Enabling Proxy ARP

Proxy ARP is enabled at the interface level:

set interfaces ethernet eth0 ip enable-proxy-arp
commit

Using Proxy ARP

Scenario 1: Subnets within a single broadcast domain

Topology:

[Host A: 192.168.1.10/24] --- [VyOS eth0] --- [Host B: 192.168.2.20/24]
                               Proxy ARP

Configuration:

set interfaces ethernet eth0 address 192.168.1.1/24
set interfaces ethernet eth0 address 192.168.2.1/24
set interfaces ethernet eth0 ip enable-proxy-arp
commit

VyOS will respond to ARP requests for both subnets, allowing the hosts to communicate.

Scenario 2: Transparent routing

set interfaces ethernet eth0 ip enable-proxy-arp
set interfaces ethernet eth1 ip enable-proxy-arp
commit

Disabling Proxy ARP

delete interfaces ethernet eth0 ip enable-proxy-arp
commit

Verifying Proxy ARP

Check the configuration:

show configuration commands | grep proxy-arp

Check the status:

show interfaces ethernet eth0

ARP Filtering and security

ARP Filtering

ARP filtering helps prevent ARP spoofing attacks by validating ARP packets.

Enabling ARP filtering on an interface (via sysctl):

set interfaces ethernet eth0 ip arp-filter
commit

Configuring the ARP cache timeout

Changing the lifetime of ARP entries (in seconds):

set system sysctl parameter net.ipv4.neigh.default.gc_stale_time value 3600
commit

ARP cache parameters:

  • gc_stale_time - the time before an entry is marked as stale (3600 sec = 1 hour)
  • gc_thresh1 - the minimum number of entries
  • gc_thresh2 - the garbage collection threshold
  • gc_thresh3 - the maximum number of entries

Limiting the ARP table size

set system sysctl parameter net.ipv4.neigh.default.gc_thresh1 value 128
set system sysctl parameter net.ipv4.neigh.default.gc_thresh2 value 512
set system sysctl parameter net.ipv4.neigh.default.gc_thresh3 value 1024
commit

Protection against ARP spoofing

Using static ARP entries for critical nodes:

# Gateway
set protocols static arp interface eth0 address 192.168.1.1 mac 00:1a:2b:3c:4d:5e

# DNS servers
set protocols static arp interface eth0 address 192.168.1.53 mac 00:1a:2b:3c:4d:5f

# Critical servers
set protocols static arp interface eth0 address 192.168.1.100 mac 00:1a:2b:3c:4d:60

commit

ARP announce settings

Controlling ARP announcement behavior:

set system sysctl parameter net.ipv4.conf.all.arp_announce value 2
commit

Values:

  • 0 - use any local address
  • 1 - avoid addresses that are not in the target subnet
  • 2 - always use the best local address for this target

ARP ignore settings

Controlling responses to ARP requests:

set system sysctl parameter net.ipv4.conf.all.arp_ignore value 1
commit

Values:

  • 0 - reply to any request for any local address
  • 1 - reply only if the request’s IP address is configured on this interface
  • 2-8 - various filtering modes

Gratuitous ARP

A gratuitous ARP is an ARP request/reply sent by a node to announce or update its own IP-to-MAC mapping without a request from other nodes.

Using Gratuitous ARP

Gratuitous ARP is used for:

  • Detecting duplicate IP addresses
  • Updating the ARP cache on other nodes
  • Failover in VRRP/HSRP
  • After a MAC address change
  • Rapidly updating switch tables

Sending Gratuitous ARP

VyOS automatically sends gratuitous ARP when:

  • An interface comes up
  • An IP address changes
  • A VRRP failover occurs

Manual sending (via operational mode):

reset arp interface eth0

Configuring accept_gratuitous_arp

Accepting gratuitous ARP packets:

set system sysctl parameter net.ipv4.conf.all.arp_accept value 1
commit

Values:

  • 0 - do not accept (default)
  • 1 - create new entries from gratuitous ARP

Configuration examples

Example 1: Yandex Cloud - Static ARP for critical infrastructure

Scenario: A critical infrastructure is deployed in Yandex Cloud with a VyOS router, a database server, and an application server. The ARP entries need to be pinned to prevent ARP spoofing.

Topology:

[VyOS Router]
      |
      | eth0: 192.168.10.0/24
      |
      +--- Database Server: 192.168.10.10
      +--- App Server: 192.168.10.20
      +--- Backup Server: 192.168.10.30

Configuration:

# Network interface
set interfaces ethernet eth0 address 192.168.10.1/24
set interfaces ethernet eth0 description 'Internal Infrastructure Network'

# Static ARP for critical servers
set protocols static arp interface eth0 address 192.168.10.10 mac 52:54:00:aa:bb:01
set protocols static arp interface eth0 address 192.168.10.20 mac 52:54:00:aa:bb:02
set protocols static arp interface eth0 address 192.168.10.30 mac 52:54:00:aa:bb:03

# ARP security settings
set system sysctl parameter net.ipv4.conf.eth0.arp_announce value 2
set system sysctl parameter net.ipv4.conf.eth0.arp_ignore value 1

# ARP cache limits
set system sysctl parameter net.ipv4.neigh.eth0.gc_stale_time value 7200

commit
save

Verification:

show protocols static arp
show arp

Expected result:

Address                  HWtype  HWaddress           Flags Mask     Iface
192.168.10.10            ether   52:54:00:aa:bb:01   CM             eth0
192.168.10.20            ether   52:54:00:aa:bb:02   CM             eth0
192.168.10.30            ether   52:54:00:aa:bb:03   CM             eth0

The “CM” flag confirms the static (Manual) entries.

Example 2: VK Cloud - ARP security in a multi-tenant environment

Scenario: VK Cloud hosting with several customers on isolated VLANs. VyOS acts as the edge router with Proxy ARP to provide connectivity and protection against ARP attacks.

Topology:

                    [VyOS Edge Router]
                            |
         +------------------+------------------+
         |                  |                  |
    eth0.100           eth0.200           eth0.300
    VLAN 100           VLAN 200           VLAN 300
   Customer A         Customer B         Customer C
   10.100.0.0/24      10.200.0.0/24      10.300.0.0/24

Configuration:

# VLAN interfaces
set interfaces ethernet eth0 vif 100 address 10.100.0.1/24
set interfaces ethernet eth0 vif 100 description 'Customer A Network'
set interfaces ethernet eth0 vif 200 address 10.200.0.1/24
set interfaces ethernet eth0 vif 200 description 'Customer B Network'
set interfaces ethernet eth0 vif 300 address 10.300.0.1/24
set interfaces ethernet eth0 vif 300 description 'Customer C Network'

# Proxy ARP for each VLAN
set interfaces ethernet eth0 vif 100 ip enable-proxy-arp
set interfaces ethernet eth0 vif 200 ip enable-proxy-arp
set interfaces ethernet eth0 vif 300 ip enable-proxy-arp

# Static ARP for default gateways (spoofing protection)
set protocols static arp interface eth0.100 address 10.100.0.254 mac 00:0c:29:aa:00:01
set protocols static arp interface eth0.200 address 10.200.0.254 mac 00:0c:29:aa:00:02
set protocols static arp interface eth0.300 address 10.300.0.254 mac 00:0c:29:aa:00:03

# ARP security on all interfaces
set system sysctl parameter net.ipv4.conf.all.arp_announce value 2
set system sysctl parameter net.ipv4.conf.all.arp_ignore value 1
set system sysctl parameter net.ipv4.conf.all.arp_accept value 0

# ARP table limit for each VLAN
set system sysctl parameter net.ipv4.neigh.eth0/100.gc_thresh1 value 64
set system sysctl parameter net.ipv4.neigh.eth0/100.gc_thresh2 value 256
set system sysctl parameter net.ipv4.neigh.eth0/100.gc_thresh3 value 512

set system sysctl parameter net.ipv4.neigh.eth0/200.gc_thresh1 value 64
set system sysctl parameter net.ipv4.neigh.eth0/200.gc_thresh2 value 256
set system sysctl parameter net.ipv4.neigh.eth0/200.gc_thresh3 value 512

set system sysctl parameter net.ipv4.neigh.eth0/300.gc_thresh1 value 64
set system sysctl parameter net.ipv4.neigh.eth0/300.gc_thresh2 value 256
set system sysctl parameter net.ipv4.neigh.eth0/300.gc_thresh3 value 512

# Firewall for isolation between VLANs
set firewall ipv4 name CUSTOMER-ISOLATION default-action drop
set firewall ipv4 name CUSTOMER-ISOLATION rule 10 action accept
set firewall ipv4 name CUSTOMER-ISOLATION rule 10 state established
set firewall ipv4 name CUSTOMER-ISOLATION rule 10 state related

# Applying the firewall
set interfaces ethernet eth0 vif 100 firewall in name CUSTOMER-ISOLATION
set interfaces ethernet eth0 vif 200 firewall in name CUSTOMER-ISOLATION
set interfaces ethernet eth0 vif 300 firewall in name CUSTOMER-ISOLATION

commit
save

Verification:

show protocols static arp
show arp interface eth0.100
show arp interface eth0.200
show arp interface eth0.300
show interfaces ethernet eth0 vif 100

Example 3: Protection against ARP spoofing on a corporate network

Scenario: A corporate network with critical servers and workstations. The key infrastructure needs to be protected from ARP spoofing attacks.

Configuration:

# Critical servers - static ARP
set protocols static arp interface eth1 address 192.168.100.10 mac 00:50:56:aa:bb:10
set protocols static arp interface eth1 address 192.168.100.20 mac 00:50:56:aa:bb:20
set protocols static arp interface eth1 address 192.168.100.30 mac 00:50:56:aa:bb:30

# DNS servers
set protocols static arp interface eth1 address 192.168.100.53 mac 00:50:56:aa:bb:53
set protocols static arp interface eth1 address 192.168.100.54 mac 00:50:56:aa:bb:54

# Domain controllers
set protocols static arp interface eth1 address 192.168.100.100 mac 00:50:56:aa:bb:c1
set protocols static arp interface eth1 address 192.168.100.101 mac 00:50:56:aa:bb:c2

# ARP security
set system sysctl parameter net.ipv4.conf.eth1.arp_announce value 2
set system sysctl parameter net.ipv4.conf.eth1.arp_ignore value 1
set system sysctl parameter net.ipv4.conf.eth1.arp_accept value 0

# Increased lifetime for static entries
set system sysctl parameter net.ipv4.neigh.eth1.gc_stale_time value 14400

commit
save

Example 4: Proxy ARP for legacy equipment

Scenario: Legacy devices with fixed IP addresses in different subnets need to communicate without any configuration changes.

Topology:

[Legacy Device A: 10.1.1.100/24] --- [VyOS] --- [Legacy Device B: 10.2.2.200/24]
                                   eth0   eth1
                                Proxy ARP enabled

Configuration:

# Interface configuration
set interfaces ethernet eth0 address 10.1.1.1/24
set interfaces ethernet eth0 description 'Legacy Network A'
set interfaces ethernet eth1 address 10.2.2.1/24
set interfaces ethernet eth1 description 'Legacy Network B'

# Enable Proxy ARP
set interfaces ethernet eth0 ip enable-proxy-arp
set interfaces ethernet eth1 ip enable-proxy-arp

# Static routes to provide connectivity
set protocols static route 10.1.1.0/24 interface eth0
set protocols static route 10.2.2.0/24 interface eth1

# Optional: static ARP for legacy devices
set protocols static arp interface eth0 address 10.1.1.100 mac aa:bb:cc:dd:ee:01
set protocols static arp interface eth1 address 10.2.2.200 mac aa:bb:cc:dd:ee:02

commit
save

Example 5: High-availability with VRRP and Gratuitous ARP

Scenario: Two VyOS routers in a VRRP cluster. On failover, the clients’ ARP tables need to be updated quickly.

Configuration (Master):

# VRRP configuration
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth0
set high-availability vrrp group LAN virtual-address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

# Accept gratuitous ARP for fast failover
set system sysctl parameter net.ipv4.conf.eth0.arp_accept value 1

# Static ARP for critical servers
set protocols static arp interface eth0 address 192.168.1.10 mac 00:50:56:11:22:33
set protocols static arp interface eth0 address 192.168.1.20 mac 00:50:56:11:22:44

commit
save

Configuration (Backup):

# VRRP configuration
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth0
set high-availability vrrp group LAN virtual-address 192.168.1.1/24
set high-availability vrrp group LAN priority 100

# Accept gratuitous ARP for fast failover
set system sysctl parameter net.ipv4.conf.eth0.arp_accept value 1

# The same static ARP entries
set protocols static arp interface eth0 address 192.168.1.10 mac 00:50:56:11:22:33
set protocols static arp interface eth0 address 192.168.1.20 mac 00:50:56:11:22:44

commit
save

On failover, VRRP automatically sends a gratuitous ARP for the virtual IP 192.168.1.1, updating the ARP tables of all clients.

Operational commands

Viewing ARP information

All ARP entries:

show arp

Static ARP configuration:

show protocols static arp

ARP for a specific interface:

show protocols static arp interface eth0

ARP entries in tabular format:

show arp | column -t

Search for a specific IP:

show arp | grep 192.168.1.10

Configuration commands

Show the ARP configuration:

show configuration protocols static arp

Show the entire configuration with ARP:

show configuration commands | grep arp

Resetting the ARP cache

Clear the entire dynamic ARP cache:

reset arp cache

Clear for a specific address:

reset arp cache address 192.168.1.10

Clear for an interface:

reset arp cache interface eth0

ARP monitoring

Viewing interface ARP statistics:

show interfaces ethernet eth0 statistics

Continuous monitoring of the ARP table:

watch -n 2 show arp

Debugging ARP

Enable ARP debugging (temporarily):

monitor protocol arp

Viewing the kernel ARP table:

run show arp

Checking ARP with tcpdump:

monitor traffic interface eth0 filter "arp"

Troubleshooting

Problem: ARP entries are not being created

Symptoms:

  • Ping does not go through
  • The ARP table shows “(incomplete)”
  • No connectivity with a node on the local network

Diagnostics:

# Check the ARP table
show arp

# Check the interface
show interfaces ethernet eth0

# Check L2 connectivity
monitor traffic interface eth0 filter "arp"

Solutions:

  1. Check the physical connection
  2. Make sure the interface is in the “up” state
  3. Check the VLAN configuration
  4. Check the firewall rules
  5. Make sure the target node responds to ARP

Problem: A static ARP entry is not applied

Symptoms:

  • After commit, the static entry does not appear in the ARP table
  • A dynamic entry overrides the static one

Diagnostics:

# Check the configuration
show configuration protocols static arp

# Check the ARP table
show arp
show protocols static arp

Solutions:

  1. Verify the correctness of the IP and MAC addresses
  2. Make sure the interface exists and is active
  3. Clear the ARP cache and recreate the entry:
    reset arp cache
commit
  4. Check the command syntax
  5. Reload the interface:
    set interfaces ethernet eth0 disable
commit
delete interfaces ethernet eth0 disable
commit

Problem: ARP spoofing attack

Symptoms:

  • Unstable connectivity
  • Traffic is being intercepted
  • Changing MAC addresses for a single IP
  • Security alerts from an IDS

Diagnostics:

# Monitor ARP changes
watch -n 1 show arp

# Check for duplicate IPs
show arp | sort -k1 | uniq -d -f1

Solutions:

  1. Use static ARP for critical nodes
  2. Enable ARP filtering:
    set system sysctl parameter net.ipv4.conf.all.arp_ignore value 1
set system sysctl parameter net.ipv4.conf.all.arp_accept value 0
  3. Configure port security on the switches
  4. Use DHCP snooping
  5. Enable Dynamic ARP Inspection (DAI) on the switches
  6. Monitor the ARP table for anomalies

Problem: ARP table overflow

Symptoms:

  • ARP entries are not being created
  • “Neighbor table overflow” messages
  • Degraded network performance

Diagnostics:

# Check the ARP table size
show arp | wc -l

# Check the kernel parameters
show system sysctl | grep neigh

Solutions:

  1. Increase the ARP table size:
    set system sysctl parameter net.ipv4.neigh.default.gc_thresh1 value 256
set system sysctl parameter net.ipv4.neigh.default.gc_thresh2 value 1024
set system sysctl parameter net.ipv4.neigh.default.gc_thresh3 value 2048
commit
  2. Reduce the entry lifetime:
    set system sysctl parameter net.ipv4.neigh.default.gc_stale_time value 60
commit
  3. Split large broadcast domains into smaller VLANs
  4. Investigate a possible ARP flood attack

Problem: Proxy ARP does not work

Symptoms:

  • Nodes in different subnets cannot see each other
  • VyOS does not respond to ARP requests for other subnets

Diagnostics:

# Check the Proxy ARP configuration
show configuration interfaces ethernet eth0 | grep proxy

# Monitor ARP traffic
monitor traffic interface eth0 filter "arp"

# Check routing
show ip route

Solutions:

  1. Make sure Proxy ARP is enabled on the correct interface:
    set interfaces ethernet eth0 ip enable-proxy-arp
commit
  2. Verify that the routes are configured correctly
  3. Check the firewall rules
  4. Make sure IP forwarding is enabled (enabled by default on VyOS)
  5. Make sure the subnets do not overlap

Problem: Slow ARP resolution

Symptoms:

  • Delays on the first connection
  • Timeouts when establishing a connection
  • Slow ping of the first packet

Diagnostics:

# Check the ARP timeout
show system sysctl | grep gc_stale

# Performance test
ping 192.168.1.10 -c 10

Solutions:

  1. Use static ARP for frequently used nodes
  2. Increase the lifetime of ARP entries:
    set system sysctl parameter net.ipv4.neigh.default.gc_stale_time value 3600
commit
  3. Configure gratuitous ARP on critical servers
  4. Check network performance (latency, packet loss)

Best practices

Security

  1. Static ARP for critical infrastructure

    • Default gateway
    • DNS servers
    • Domain controllers
    • Database servers
    • Management interfaces

  2. ARP filtering

    set system sysctl parameter net.ipv4.conf.all.arp_ignore value 1
set system sysctl parameter net.ipv4.conf.all.arp_accept value 0
set system sysctl parameter net.ipv4.conf.all.arp_announce value 2

  3. Limiting the ARP table size

    • Preventing DoS attacks
    • Protection against ARP table exhaustion

  4. Monitoring ARP anomalies

    • Automatic alerts on duplicate IPs/MACs
    • Logging changes in the ARP table

Performance

  1. Optimizing the ARP timeout

    • Balance between performance and load
    • For stable networks: increase the timeout
    • For dynamic networks: decrease the timeout

  2. Correct ARP table size

    • gc_thresh1: the minimum to prevent GC
    • gc_thresh2: the start of soft GC
    • gc_thresh3: the maximum, hard limit

  3. Using Proxy ARP wisely

    • Only when necessary
    • Minimize broadcast domains

Documentation

  1. Document static ARP

    • Maintain a list of all static entries
    • Note the reason for creating each one
    • Update when changes occur

  2. Naming convention

    • Use description for interfaces
    • Comments in the configuration

Monitoring and maintenance

  1. Regular ARP table checks

    show arp
show protocols static arp

  2. Monitoring automation

    • Scripts to check consistency
    • Alerts on changes to critical entries

  3. Configuration backups

    • Regular configuration backups
    • Version control for changes

  4. Failover testing

    • Verify VRRP failover with gratuitous ARP
    • Test backup routes

Scaling

  1. Splitting broadcast domains

    • Using VLANs
    • Reducing the size of L2 domains

  2. Hierarchical architecture

    • Core/Distribution/Access model
    • Minimizing ARP traffic between layers

  3. IPv6 migration

    • NDP is more efficient than ARP
    • Built-in protection against spoofing (SEND)

IPv6 and Neighbor Discovery

For IPv6 networks, ARP is replaced by the Neighbor Discovery Protocol (NDP), which is part of ICMPv6.

Key differences

ARP (IPv4):

  • A separate protocol
  • Broadcast
  • Vulnerable to spoofing

NDP (IPv6):

  • Part of ICMPv6
  • Multicast (more efficient)
  • SEND (Secure Neighbor Discovery) for protection

Static IPv6 neighbors

The equivalent of static ARP for IPv6:

set protocols static neighbor interface eth0 address 2001:db8::10 mac 00:11:22:33:44:55
commit

Viewing IPv6 neighbors

show ipv6 neighbors

Integration with other protocols

ARP and VRRP/HSRP

On failover, VRRP/HSRP automatically sends a gratuitous ARP to update the clients’ tables.

Configuration for fast failover:

set system sysctl parameter net.ipv4.conf.all.arp_accept value 1

ARP and DHCP

A DHCP server can use ARP to check the uniqueness of IP addresses before issuing a lease.

ARP and VPN

For overlay networks (VXLAN, GRE), ARP is proxied through the tunnels.

Next steps

  • Static routing - configuring static routes
  • OSPF - dynamic routing for the enterprise
  • BGP - routing for connecting to an ISP
  • Firewall - configuring firewall rules
  • VLAN - virtual local area networks
Reviewed by OpenNix LLC · Last updated on
Routing in VyOSStatic Routing (Static Routes)