Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Duplicate IP on a default gateway interface = Bad

I just had an entire VLAN drop out due to a host being brought onto the network that had been erroneously configured with a static IP that happened to be in conflict with the HSRP default gateway IP of the core switch; fortunately, we were able to remove the offending host and reconfigure default gateways as a workaround until the core switch's ARP table updated.

Is there any way to configure a 6500 running IOS to inhibit or block a conflicting IP (especially one with a gateway IP) by using a static ARP entry or other authoritative command?

Thanks,

Marc

3 REPLIES

Re: Duplicate IP on a default gateway interface = Bad

One could configure a static arp for the hsrp virtual mac address. (I've never tried it but I do not see why this should not work.)

However, this will only reduce the impact of such a misconfiguration as you cannot prevent any other hosts from receiving the wrong arp-reply.

The urge to configure all components is such a way that everything is as stable as possible is understandable although I do not think that this can be achieved. Every addition increases the complexity of your network and very often there are considerable drawbacks attached to changes.

The best protection against this kind of problem is an effective change management which should have prevented the connection of a server with such a disastrous misconfiguration. For the rest; the best advice is to keep it simple. This will make your network easier to troubleshoot.

Regards,

Leo

Re: Duplicate IP on a default gateway interface = Bad

you can setup a ARP access-list blocking hosts from ARPing to you GW address. My below config is from a 3550 but I have checked the documentation for 6500 and the arp ACL is also available on this platform (see URL below).

arp access-list CCIE

deny ip 172.25.0.1 0.0.255.0 mac any

permit ip any mac any

ip arp inspection filter CCIE vlan 9-11

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/122sx/cmdref/chap2a.htm#wp1067063

New Member

Re: Duplicate IP on a default gateway interface = Bad

Hi,

You may use the following.

enable Unicast Reverse Path Forwarding on an interface. Unicast RPF guards against IP spoofing (a packet uses an incorrect source IP address to obscure its true source) by ensuring that all packets have a source IP address that matches the correct source interface according to the routing table.

Normally, the FWSM only looks at the destination address when determining where to forward the packet. Unicast RPF instructs the FWSM to also look at the source address; this is why it is called Reverse Path Forwarding. For any traffic that you want to allow through the FWSM, the FWSM routing table must include a route back to the source address. See RFC 2267 for more information.

For outside traffic, for example, the FWSM can use the default route to satisfy the Unicast RPF protection. If traffic enters from an outside interface, and the source address is not known to the routing table, the FWSM uses the default route to correctly identify the outside interface as the source interface.

If traffic enters the outside interface from an address that is known to the routing table, but is associated with the inside interface, then the FWSM drops the packet. Similarly, if traffic enters the inside interface from an unknown source address, the FWSM drops the packet because the matching route (the default route) indicates the outside interface.

Unicast RPF is implemented as follows:

?ICMP packets have no session, so each packet is checked.

?UDP and TCP have sessions, so the initial packet requires a reverse route lookup. Subsequent packets arriving during the session are checked using an existing state maintained as part of the session. Non-initial packets are checked to ensure they arrived on the same interface used by the initial packet.

To enable Unicast RPF, enter the following command:

hostname(config)# ip verify reverse-path interface interface_name

http://www.cisco.com/en/US/products/hw/switches/ps708/products_module_configuration_guide_chapter09186a0080577c66.html#wp1042625

It may be useful..

Rgrds

Rajeev.S

2659
Views
5
Helpful
3
Replies
CreatePlease login to create content