no ip redirects/no ip proxy-arp in GLBP

[alsayed]

hello!

when you configure GLBP ON THE interface vlan.do we need to configure no ip proxy-arp?it works without this command as well as this command also:no ip redirects

[Jon Marshall]

Hi Ali

They are not really related as such. You can run GLBP with them on or off. I usually turn off any unneeded services under the interface.

Jon

[Edison Ortiz]

proxy-arp provides services for devices on that segment that do not have a default gateway. If you want to ensure the devices on that segment use the GLBP VIP address, then disabling proxy-arp will be recommended.

As for ip redirect, it has no correlation to GLBP but is a recommended security practice to disable it. If you disable ip redirect, the devices on that segment will always contact their default gateway (GLBP VIP) if more than one gateway exists on that segment.

[alsayed]

hello experts!

i have seen the following config under:

HSPR

INT VLAN X

NO IP REDIRECTS

GLBP

INT VLAN X

NO IP PROXY ARP

SO WHAT THAT MEAN?

MANY 10XS

[alsayed]

HELLO

if i forget to configure it under the vlan interface(no proxy arp).then what's hapen?

10xs

[Edison Ortiz]

If you forget to configure no ip proxy-arp under an interface, devices on that subnet with missing default gateway will be serviced by this interface.

For instance,

If you have a workstation with IP 192.168.1.150 (missing its default gateway) and a switch with 192.168.1.1 with proxy-arp enabled, the switch will respond to arp queries from the workstation and route to other segments on the workstation's behalf.

This behavior will cause a lot of overhead in the switch and network as you rely on ARP for routing to other segments.

By disabling proxy-arp, the switch does not route the packet and the workstation gets a request time-out if the destination resides in another subnet.

[royalblues]

As said above these commands are generally configured as a security practice.

have a look at the attached document

HTH

Narayan

[alsayed]

10xs narayan