# ARP - Address Resolution Protocol

> Configure ARP on VyOS: static ARP entries, Proxy ARP, ARP table, ARP security, and gratuitous ARP for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/routing/vyos-arp/


The Address Resolution Protocol (ARP) is a network-layer protocol used to map IP addresses (IPv4) to MAC addresses (hardware addresses) within local Ethernet networks.

## Overview

ARP is a critically important protocol for the operation of IPv4 networks:
- Mapping IP addresses to MAC addresses
- Caching mappings to reduce network traffic
- Dynamically updating the ARP table
- Support for static entries for critical infrastructure
- Proxy ARP for inter-network communication

**Core ARP functions**:
- Address resolution within the local network
- Maintaining the ARP cache
- Processing ARP requests and replies
- Providing connectivity at the link layer

**For IPv6**, the Neighbor Discovery Protocol (NDP) is used, which is part of ICMPv6.

### How ARP works

1. **ARP Request**: A host sends a broadcast query "Who has IP X?"
2. **ARP Reply**: The node with IP X responds with its MAC address
3. **Caching**: Both nodes store the IP-to-MAC mapping in their ARP table
4. **Timeout**: Entries age out and are removed after a set time (by default ~60 seconds)

### Types of ARP entries

**Dynamic ARP**:
- Created automatically during the exchange of ARP requests/replies
- Have a limited lifetime (TTL)
- Refreshed when used
- Removed when they expire

**Static ARP**:
- Created manually by the administrator
- Do not expire automatically
- Used for critical nodes
- Protection against ARP spoofing
- Marked with the "CM" flag (Complete, Manual)

## Static ARP entries

Static ARP entries are used to permanently bind an IP address to a MAC address without automatic expiration.

### Basic configuration

Creating a static ARP entry:

```
set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01
commit
```

Syntax:
```
set protocols static arp interface <interface> address <IP> mac <MAC>
```

Parameters:
- **interface** - the network interface (eth0, eth1, bond0, etc.)
- **address** - the node's IPv4 address
- **mac** - the MAC address in XX:XX:XX:XX:XX:XX format

### Multiple static entries

```
set protocols static arp interface eth0 address 192.168.1.10 mac 00:11:22:33:44:55
set protocols static arp interface eth0 address 192.168.1.20 mac 00:11:22:33:44:66
set protocols static arp interface eth0 address 192.168.1.30 mac 00:11:22:33:44:77
commit
```

### Static ARP for different interfaces

```
set protocols static arp interface eth0 address 192.168.1.1 mac aa:bb:cc:dd:ee:01
set protocols static arp interface eth1 address 10.0.0.1 mac aa:bb:cc:dd:ee:02
set protocols static arp interface eth2 address 172.16.0.1 mac aa:bb:cc:dd:ee:03
commit
```

### Removing a static entry

```
delete protocols static arp interface eth0 address 192.168.1.10
commit
```

## Viewing the ARP table

### Show all ARP entries

```
show arp
```

Example output:
```
Address                  HWtype  HWaddress           Flags Mask     Iface
10.1.1.1                 ether   00:53:00:de:23:2e   C              eth1
10.1.1.100               ether   00:53:00:de:23:aa   CM             eth1
192.168.1.1              ether   52:54:00:12:34:56   C              eth0
192.168.1.10                     (incomplete)                       eth0
```

Flag meanings:
- **C** (Complete) - the entry is complete and valid
- **M** (Manual/Permanent) - a static entry
- **P** (Published) - a proxy ARP entry
- **(incomplete)** - address resolution has not completed

### Show static ARP entries

```
show protocols static arp
```

Displays only the statically configured ARP entries:
```
Address                  HWtype  HWaddress           Flags Mask     Iface
10.1.1.100               ether   00:53:00:de:23:aa   CM             eth1
192.168.1.10             ether   00:11:22:33:44:55   CM             eth0
```

### Show ARP for a specific interface

```
show protocols static arp interface eth1
```

Output for the specified interface only:
```
Address                  HWtype  HWaddress           Flags Mask     Iface
10.1.1.100               ether   00:53:00:de:23:aa   CM             eth1
```

### Operational commands

Show ARP statistics:
```
show interfaces ethernet eth0 statistics
```

Clear the dynamic ARP cache (requires operational mode):
```
reset arp cache
```

Clear ARP for a specific address:
```
reset arp cache address 192.168.1.10
```

## Proxy ARP

Proxy ARP allows the router to reply to ARP requests on behalf of other nodes that reside in a different subnet or are not directly reachable.

### Enabling Proxy ARP

Proxy ARP is enabled at the interface level:

```
set interfaces ethernet eth0 ip enable-proxy-arp
commit
```

### Using Proxy ARP

**Scenario 1: Subnets within a single broadcast domain**

Topology:
```
[Host A: 192.168.1.10/24] --- [VyOS eth0] --- [Host B: 192.168.2.20/24]
                               Proxy ARP
```

Configuration:
```
set interfaces ethernet eth0 address 192.168.1.1/24
set interfaces ethernet eth0 address 192.168.2.1/24
set interfaces ethernet eth0 ip enable-proxy-arp
commit
```

VyOS will respond to ARP requests for both subnets, allowing the hosts to communicate.

**Scenario 2: Transparent routing**

```
set interfaces ethernet eth0 ip enable-proxy-arp
set interfaces ethernet eth1 ip enable-proxy-arp
commit
```

### Disabling Proxy ARP

```
delete interfaces ethernet eth0 ip enable-proxy-arp
commit
```

### Verifying Proxy ARP

Check the configuration:
```
show configuration commands | grep proxy-arp
```

Check the status:
```
show interfaces ethernet eth0
```

## ARP Filtering and security

### ARP Filtering

ARP filtering helps prevent ARP spoofing attacks by validating ARP packets.

Enabling ARP filtering on an interface (via sysctl):

```
set interfaces ethernet eth0 ip arp-filter
commit
```

### Configuring the ARP cache timeout

Changing the lifetime of ARP entries (in seconds):

```
set system sysctl parameter net.ipv4.neigh.default.gc_stale_time value 3600
commit
```

ARP cache parameters:
- **gc_stale_time** - the time before an entry is marked as stale (3600 sec = 1 hour)
- **gc_thresh1** - the minimum number of entries
- **gc_thresh2** - the garbage collection threshold
- **gc_thresh3** - the maximum number of entries

### Limiting the ARP table size

```
set system sysctl parameter net.ipv4.neigh.default.gc_thresh1 value 128
set system sysctl parameter net.ipv4.neigh.default.gc_thresh2 value 512
set system sysctl parameter net.ipv4.neigh.default.gc_thresh3 value 1024
commit
```

### Protection against ARP spoofing

Using static ARP entries for critical nodes:

```
# Gateway
set protocols static arp interface eth0 address 192.168.1.1 mac 00:1a:2b:3c:4d:5e

# DNS servers
set protocols static arp interface eth0 address 192.168.1.53 mac 00:1a:2b:3c:4d:5f

# Critical servers
set protocols static arp interface eth0 address 192.168.1.100 mac 00:1a:2b:3c:4d:60

commit
```

### ARP announce settings

Controlling ARP announcement behavior:

```
set system sysctl parameter net.ipv4.conf.all.arp_announce value 2
commit
```

Values:
- **0** - use any local address
- **1** - avoid addresses that are not in the target subnet
- **2** - always use the best local address for this target

### ARP ignore settings

Controlling responses to ARP requests:

```
set system sysctl parameter net.ipv4.conf.all.arp_ignore value 1
commit
```

Values:
- **0** - reply to any request for any local address
- **1** - reply only if the request's IP address is configured on this interface
- **2-8** - various filtering modes

## Gratuitous ARP

A gratuitous ARP is an ARP request/reply sent by a node to announce or update its own IP-to-MAC mapping without a request from other nodes.

### Using Gratuitous ARP

Gratuitous ARP is used for:
- Detecting duplicate IP addresses
- Updating the ARP cache on other nodes
- Failover in VRRP/HSRP
- After a MAC address change
- Rapidly updating switch tables

### Sending Gratuitous ARP

VyOS automatically sends gratuitous ARP when:
- An interface comes up
- An IP address changes
- A VRRP failover occurs

Manual sending (via operational mode):
```
reset arp interface eth0
```

### Configuring accept_gratuitous_arp

Accepting gratuitous ARP packets:

```
set system sysctl parameter net.ipv4.conf.all.arp_accept value 1
commit
```

Values:
- **0** - do not accept (default)
- **1** - create new entries from gratuitous ARP

## Configuration examples

### Example 1: Yandex Cloud - Static ARP for critical infrastructure

**Scenario**: A critical infrastructure is deployed in Yandex Cloud with a VyOS router, a database server, and an application server. The ARP entries need to be pinned to prevent ARP spoofing.

**Topology**:
```
[VyOS Router]
      |
      | eth0: 192.168.10.0/24
      |
      +--- Database Server: 192.168.10.10
      +--- App Server: 192.168.10.20
      +--- Backup Server: 192.168.10.30
```

**Configuration**:
```
# Network interface
set interfaces ethernet eth0 address 192.168.10.1/24
set interfaces ethernet eth0 description 'Internal Infrastructure Network'

# Static ARP for critical servers
set protocols static arp interface eth0 address 192.168.10.10 mac 52:54:00:aa:bb:01
set protocols static arp interface eth0 address 192.168.10.20 mac 52:54:00:aa:bb:02
set protocols static arp interface eth0 address 192.168.10.30 mac 52:54:00:aa:bb:03

# ARP security settings
set system sysctl parameter net.ipv4.conf.eth0.arp_announce value 2
set system sysctl parameter net.ipv4.conf.eth0.arp_ignore value 1

# ARP cache limits
set system sysctl parameter net.ipv4.neigh.eth0.gc_stale_time value 7200

commit
save
```

**Verification**:
```
show protocols static arp
show arp
```

**Expected result**:
```
Address                  HWtype  HWaddress           Flags Mask     Iface
192.168.10.10            ether   52:54:00:aa:bb:01   CM             eth0
192.168.10.20            ether   52:54:00:aa:bb:02   CM             eth0
192.168.10.30            ether   52:54:00:aa:bb:03   CM             eth0
```

The "CM" flag confirms the static (Manual) entries.

### Example 2: VK Cloud - ARP security in a multi-tenant environment

**Scenario**: VK Cloud hosting with several customers on isolated VLANs. VyOS acts as the edge router with Proxy ARP to provide connectivity and protection against ARP attacks.

**Topology**:
```
                    [VyOS Edge Router]
                            |
         +------------------+------------------+
         |                  |                  |
    eth0.100           eth0.200           eth0.300
    VLAN 100           VLAN 200           VLAN 300
   Customer A         Customer B         Customer C
   10.100.0.0/24      10.200.0.0/24      10.300.0.0/24
```

**Configuration**:
```
# VLAN interfaces
set interfaces ethernet eth0 vif 100 address 10.100.0.1/24
set interfaces ethernet eth0 vif 100 description 'Customer A Network'
set interfaces ethernet eth0 vif 200 address 10.200.0.1/24
set interfaces ethernet eth0 vif 200 description 'Customer B Network'
set interfaces ethernet eth0 vif 300 address 10.300.0.1/24
set interfaces ethernet eth0 vif 300 description 'Customer C Network'

# Proxy ARP for each VLAN
set interfaces ethernet eth0 vif 100 ip enable-proxy-arp
set interfaces ethernet eth0 vif 200 ip enable-proxy-arp
set interfaces ethernet eth0 vif 300 ip enable-proxy-arp

# Static ARP for default gateways (spoofing protection)
set protocols static arp interface eth0.100 address 10.100.0.254 mac 00:0c:29:aa:00:01
set protocols static arp interface eth0.200 address 10.200.0.254 mac 00:0c:29:aa:00:02
set protocols static arp interface eth0.300 address 10.300.0.254 mac 00:0c:29:aa:00:03

# ARP security on all interfaces
set system sysctl parameter net.ipv4.conf.all.arp_announce value 2
set system sysctl parameter net.ipv4.conf.all.arp_ignore value 1
set system sysctl parameter net.ipv4.conf.all.arp_accept value 0

# ARP table limit for each VLAN
set system sysctl parameter net.ipv4.neigh.eth0/100.gc_thresh1 value 64
set system sysctl parameter net.ipv4.neigh.eth0/100.gc_thresh2 value 256
set system sysctl parameter net.ipv4.neigh.eth0/100.gc_thresh3 value 512

set system sysctl parameter net.ipv4.neigh.eth0/200.gc_thresh1 value 64
set system sysctl parameter net.ipv4.neigh.eth0/200.gc_thresh2 value 256
set system sysctl parameter net.ipv4.neigh.eth0/200.gc_thresh3 value 512

set system sysctl parameter net.ipv4.neigh.eth0/300.gc_thresh1 value 64
set system sysctl parameter net.ipv4.neigh.eth0/300.gc_thresh2 value 256
set system sysctl parameter net.ipv4.neigh.eth0/300.gc_thresh3 value 512

# Firewall for isolation between VLANs
set firewall ipv4 name CUSTOMER-ISOLATION default-action drop
set firewall ipv4 name CUSTOMER-ISOLATION rule 10 action accept
set firewall ipv4 name CUSTOMER-ISOLATION rule 10 state established
set firewall ipv4 name CUSTOMER-ISOLATION rule 10 state related

# Applying the firewall
set interfaces ethernet eth0 vif 100 firewall in name CUSTOMER-ISOLATION
set interfaces ethernet eth0 vif 200 firewall in name CUSTOMER-ISOLATION
set interfaces ethernet eth0 vif 300 firewall in name CUSTOMER-ISOLATION

commit
save
```

**Verification**:
```
show protocols static arp
show arp interface eth0.100
show arp interface eth0.200
show arp interface eth0.300
show interfaces ethernet eth0 vif 100
```

### Example 3: Protection against ARP spoofing on a corporate network

**Scenario**: A corporate network with critical servers and workstations. The key infrastructure needs to be protected from ARP spoofing attacks.

**Configuration**:
```
# Critical servers - static ARP
set protocols static arp interface eth1 address 192.168.100.10 mac 00:50:56:aa:bb:10
set protocols static arp interface eth1 address 192.168.100.20 mac 00:50:56:aa:bb:20
set protocols static arp interface eth1 address 192.168.100.30 mac 00:50:56:aa:bb:30

# DNS servers
set protocols static arp interface eth1 address 192.168.100.53 mac 00:50:56:aa:bb:53
set protocols static arp interface eth1 address 192.168.100.54 mac 00:50:56:aa:bb:54

# Domain controllers
set protocols static arp interface eth1 address 192.168.100.100 mac 00:50:56:aa:bb:c1
set protocols static arp interface eth1 address 192.168.100.101 mac 00:50:56:aa:bb:c2

# ARP security
set system sysctl parameter net.ipv4.conf.eth1.arp_announce value 2
set system sysctl parameter net.ipv4.conf.eth1.arp_ignore value 1
set system sysctl parameter net.ipv4.conf.eth1.arp_accept value 0

# Increased lifetime for static entries
set system sysctl parameter net.ipv4.neigh.eth1.gc_stale_time value 14400

commit
save
```

### Example 4: Proxy ARP for legacy equipment

**Scenario**: Legacy devices with fixed IP addresses in different subnets need to communicate without any configuration changes.

**Topology**:
```
[Legacy Device A: 10.1.1.100/24] --- [VyOS] --- [Legacy Device B: 10.2.2.200/24]
                                   eth0   eth1
                                Proxy ARP enabled
```

**Configuration**:
```
# Interface configuration
set interfaces ethernet eth0 address 10.1.1.1/24
set interfaces ethernet eth0 description 'Legacy Network A'
set interfaces ethernet eth1 address 10.2.2.1/24
set interfaces ethernet eth1 description 'Legacy Network B'

# Enable Proxy ARP
set interfaces ethernet eth0 ip enable-proxy-arp
set interfaces ethernet eth1 ip enable-proxy-arp

# Static routes to provide connectivity
set protocols static route 10.1.1.0/24 interface eth0
set protocols static route 10.2.2.0/24 interface eth1

# Optional: static ARP for legacy devices
set protocols static arp interface eth0 address 10.1.1.100 mac aa:bb:cc:dd:ee:01
set protocols static arp interface eth1 address 10.2.2.200 mac aa:bb:cc:dd:ee:02

commit
save
```

### Example 5: High-availability with VRRP and Gratuitous ARP

**Scenario**: Two VyOS routers in a VRRP cluster. On failover, the clients' ARP tables need to be updated quickly.

**Configuration** (Master):
```
# VRRP configuration
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth0
set high-availability vrrp group LAN virtual-address 192.168.1.1/24
set high-availability vrrp group LAN priority 200

# Accept gratuitous ARP for fast failover
set system sysctl parameter net.ipv4.conf.eth0.arp_accept value 1

# Static ARP for critical servers
set protocols static arp interface eth0 address 192.168.1.10 mac 00:50:56:11:22:33
set protocols static arp interface eth0 address 192.168.1.20 mac 00:50:56:11:22:44

commit
save
```

**Configuration** (Backup):
```
# VRRP configuration
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth0
set high-availability vrrp group LAN virtual-address 192.168.1.1/24
set high-availability vrrp group LAN priority 100

# Accept gratuitous ARP for fast failover
set system sysctl parameter net.ipv4.conf.eth0.arp_accept value 1

# The same static ARP entries
set protocols static arp interface eth0 address 192.168.1.10 mac 00:50:56:11:22:33
set protocols static arp interface eth0 address 192.168.1.20 mac 00:50:56:11:22:44

commit
save
```

On failover, VRRP automatically sends a gratuitous ARP for the virtual IP 192.168.1.1, updating the ARP tables of all clients.

## Operational commands

### Viewing ARP information

All ARP entries:
```
show arp
```

Static ARP configuration:
```
show protocols static arp
```

ARP for a specific interface:
```
show protocols static arp interface eth0
```

ARP entries in tabular format:
```
show arp | column -t
```

Search for a specific IP:
```
show arp | grep 192.168.1.10
```

### Configuration commands

Show the ARP configuration:
```
show configuration protocols static arp
```

Show the entire configuration with ARP:
```
show configuration commands | grep arp
```

### Resetting the ARP cache

Clear the entire dynamic ARP cache:
```
reset arp cache
```

Clear for a specific address:
```
reset arp cache address 192.168.1.10
```

Clear for an interface:
```
reset arp cache interface eth0
```

### ARP monitoring

Viewing interface ARP statistics:
```
show interfaces ethernet eth0 statistics
```

Continuous monitoring of the ARP table:
```
watch -n 2 show arp
```

### Debugging ARP

Enable ARP debugging (temporarily):
```
monitor protocol arp
```

Viewing the kernel ARP table:
```
run show arp
```

Checking ARP with tcpdump:
```
monitor traffic interface eth0 filter "arp"
```

## Troubleshooting

### Problem: ARP entries are not being created

**Symptoms**:
- Ping does not go through
- The ARP table shows "(incomplete)"
- No connectivity with a node on the local network

**Diagnostics**:
```
# Check the ARP table
show arp

# Check the interface
show interfaces ethernet eth0

# Check L2 connectivity
monitor traffic interface eth0 filter "arp"
```

**Solutions**:
1. Check the physical connection
2. Make sure the interface is in the "up" state
3. Check the VLAN configuration
4. Check the firewall rules
5. Make sure the target node responds to ARP

### Problem: A static ARP entry is not applied

**Symptoms**:
- After commit, the static entry does not appear in the ARP table
- A dynamic entry overrides the static one

**Diagnostics**:
```
# Check the configuration
show configuration protocols static arp

# Check the ARP table
show arp
show protocols static arp
```

**Solutions**:
1. Verify the correctness of the IP and MAC addresses
2. Make sure the interface exists and is active
3. Clear the ARP cache and recreate the entry:
   ```
   reset arp cache
   commit
   ```
4. Check the command syntax
5. Reload the interface:
   ```
   set interfaces ethernet eth0 disable
   commit
   delete interfaces ethernet eth0 disable
   commit
   ```

### Problem: ARP spoofing attack

**Symptoms**:
- Unstable connectivity
- Traffic is being intercepted
- Changing MAC addresses for a single IP
- Security alerts from an IDS

**Diagnostics**:
```
# Monitor ARP changes
watch -n 1 show arp

# Check for duplicate IPs
show arp | sort -k1 | uniq -d -f1
```

**Solutions**:
1. Use static ARP for critical nodes
2. Enable ARP filtering:
   ```
   set system sysctl parameter net.ipv4.conf.all.arp_ignore value 1
   set system sysctl parameter net.ipv4.conf.all.arp_accept value 0
   ```
3. Configure port security on the switches
4. Use DHCP snooping
5. Enable Dynamic ARP Inspection (DAI) on the switches
6. Monitor the ARP table for anomalies

### Problem: ARP table overflow

**Symptoms**:
- ARP entries are not being created
- "Neighbor table overflow" messages
- Degraded network performance

**Diagnostics**:
```
# Check the ARP table size
show arp | wc -l

# Check the kernel parameters
show system sysctl | grep neigh
```

**Solutions**:
1. Increase the ARP table size:
   ```
   set system sysctl parameter net.ipv4.neigh.default.gc_thresh1 value 256
   set system sysctl parameter net.ipv4.neigh.default.gc_thresh2 value 1024
   set system sysctl parameter net.ipv4.neigh.default.gc_thresh3 value 2048
   commit
   ```
2. Reduce the entry lifetime:
   ```
   set system sysctl parameter net.ipv4.neigh.default.gc_stale_time value 60
   commit
   ```
3. Split large broadcast domains into smaller VLANs
4. Investigate a possible ARP flood attack

### Problem: Proxy ARP does not work

**Symptoms**:
- Nodes in different subnets cannot see each other
- VyOS does not respond to ARP requests for other subnets

**Diagnostics**:
```
# Check the Proxy ARP configuration
show configuration interfaces ethernet eth0 | grep proxy

# Monitor ARP traffic
monitor traffic interface eth0 filter "arp"

# Check routing
show ip route
```

**Solutions**:
1. Make sure Proxy ARP is enabled on the correct interface:
   ```
   set interfaces ethernet eth0 ip enable-proxy-arp
   commit
   ```
2. Verify that the routes are configured correctly
3. Check the firewall rules
4. Make sure IP forwarding is enabled (enabled by default on VyOS)
5. Make sure the subnets do not overlap

### Problem: Slow ARP resolution

**Symptoms**:
- Delays on the first connection
- Timeouts when establishing a connection
- Slow ping of the first packet

**Diagnostics**:
```
# Check the ARP timeout
show system sysctl | grep gc_stale

# Performance test
ping 192.168.1.10 -c 10
```

**Solutions**:
1. Use static ARP for frequently used nodes
2. Increase the lifetime of ARP entries:
   ```
   set system sysctl parameter net.ipv4.neigh.default.gc_stale_time value 3600
   commit
   ```
3. Configure gratuitous ARP on critical servers
4. Check network performance (latency, packet loss)

## Best practices

### Security

1. **Static ARP for critical infrastructure**
   - Default gateway
   - DNS servers
   - Domain controllers
   - Database servers
   - Management interfaces

2. **ARP filtering**
   ```
   set system sysctl parameter net.ipv4.conf.all.arp_ignore value 1
   set system sysctl parameter net.ipv4.conf.all.arp_accept value 0
   set system sysctl parameter net.ipv4.conf.all.arp_announce value 2
   ```

3. **Limiting the ARP table size**
   - Preventing DoS attacks
   - Protection against ARP table exhaustion

4. **Monitoring ARP anomalies**
   - Automatic alerts on duplicate IPs/MACs
   - Logging changes in the ARP table

### Performance

1. **Optimizing the ARP timeout**
   - Balance between performance and load
   - For stable networks: increase the timeout
   - For dynamic networks: decrease the timeout

2. **Correct ARP table size**
   - gc_thresh1: the minimum to prevent GC
   - gc_thresh2: the start of soft GC
   - gc_thresh3: the maximum, hard limit

3. **Using Proxy ARP wisely**
   - Only when necessary
   - Minimize broadcast domains

### Documentation

1. **Document static ARP**
   - Maintain a list of all static entries
   - Note the reason for creating each one
   - Update when changes occur

2. **Naming convention**
   - Use description for interfaces
   - Comments in the configuration

### Monitoring and maintenance

1. **Regular ARP table checks**
   ```
   show arp
   show protocols static arp
   ```

2. **Monitoring automation**
   - Scripts to check consistency
   - Alerts on changes to critical entries

3. **Configuration backups**
   - Regular configuration backups
   - Version control for changes

4. **Failover testing**
   - Verify VRRP failover with gratuitous ARP
   - Test backup routes

### Scaling

1. **Splitting broadcast domains**
   - Using VLANs
   - Reducing the size of L2 domains

2. **Hierarchical architecture**
   - Core/Distribution/Access model
   - Minimizing ARP traffic between layers

3. **IPv6 migration**
   - NDP is more efficient than ARP
   - Built-in protection against spoofing (SEND)

## IPv6 and Neighbor Discovery

For IPv6 networks, ARP is replaced by the Neighbor Discovery Protocol (NDP), which is part of ICMPv6.

### Key differences

**ARP (IPv4)**:
- A separate protocol
- Broadcast
- Vulnerable to spoofing

**NDP (IPv6)**:
- Part of ICMPv6
- Multicast (more efficient)
- SEND (Secure Neighbor Discovery) for protection

### Static IPv6 neighbors

The equivalent of static ARP for IPv6:

```
set protocols static neighbor interface eth0 address 2001:db8::10 mac 00:11:22:33:44:55
commit
```

### Viewing IPv6 neighbors

```
show ipv6 neighbors
```

## Integration with other protocols

### ARP and VRRP/HSRP

On failover, VRRP/HSRP automatically sends a gratuitous ARP to update the clients' tables.

Configuration for fast failover:
```
set system sysctl parameter net.ipv4.conf.all.arp_accept value 1
```

### ARP and DHCP

A DHCP server can use ARP to check the uniqueness of IP addresses before issuing a lease.

### ARP and VPN

For overlay networks (VXLAN, GRE), ARP is proxied through the tunnels.

## Next steps

- [Static routing](/docs/vyos/routing/vyos-static/) - configuring static routes
- [OSPF](/docs/vyos/routing/vyos-ospf/) - dynamic routing for the enterprise
- [BGP](/docs/vyos/routing/vyos-bgp/) - routing for connecting to an ISP
- [Firewall](/docs/vyos/firewall) - configuring firewall rules
- [VLAN](/docs/vyos/interfaces/vyos-vlan/) - virtual local area networks