Now we're going to talk about proxy ARP.
Traditional ARP is designed to facilitate communication among hosts
would share the same local network and broadcast LAN.
Let's look at a typical example and the same setup I
will use in proxy ARP demonstration.
Here, we have two networks separated by a router, the 20.
1.
0/24 network and the 20.
2.
0/24 network.
Now normally, hosts on the 20.
1.
0 network would be able to ARP and find the MAC to IP
bindings for anything on the local network.
As ARP is a broadcast protocol,
it would not be able to cross the router and resolve any hosts on the 20.
2.
0 network.
This is normal and actually a desired benefit in modern networks where
segmentation provides isolation of users and devices,
as well as bandwidth and security improvements.
The normal process for hosts is that if they want to
communicate with systems not on the same local subnet that
they employ the default-gateway router.
If necessary, they can ARP for the router's MAC address on the 20.
1.
1 interface facing the local subnet.
However, what if the host you're trying to communicate with,
F in this case,
is not on the same LAN or subnet and your machine B is unaware of this fact,
your machine will not use IP routing and cannot use broadcast ARP
to discover the location of the remote host.
What's needed is a proxy.
Why would we do this?
Well in today's network, this is a pretty uncommon scenario.
It was useful before we had operating systems which
are aware of subnets and routing.
It might occur though in some strange cases today.
For example, if we have a large LAN, say the 20.
0.
0/8 network,
and we want to break this up over time to smaller subnets as we have here.
To perform the migration, it may be useful to move machines to new IP addressing,
but leave their subnet masks believing the system is part of the larger subnet.
Please examine the Host B, it has a /8 mask, which is in dotted decimal 255.
0.
This system will see any IP address starting with 20.
as part of the local area network.
This system has not been updated to have the new
subnet scheme /24 where 3 octets 20.
1.
1 make up the network information.
Now let's assume our system B wanted to some resource at server F at 20.
2.
8, it would naturally broadcast an ARP to the local network.
Since broadcasts do not cross the router,
the ARP request would never reach the server F and the
server at F would never send an ARP reply,
Therefore, communication between the host would fail.
What we need is a proxy who knows the location of the server F and can
act on its behalf to answer ARPs and forward traffic.
The router can do this so let's assume our router
has been configured for proxy ARP, which by the way,
is the default configuration on my Cisco routers.
So let's now send the ARP from System B.
The router acting as a proxy knows the location of 20.
2.
8 from its ARP cache associated with the router interface on that network 20.
2.
0.
Acting as a proxy, it replies to B's ARP request with the reply that 20.
2.
8 is at MAC C.
Notice that this is the router's MAC for the 20.
1.
1 interface.
This is the key proxy ARP function.
The router is answering ARPs as proxy for our server at 20.
2.
8 using its own MAC address C.
Our sender B can then encapsulate the data with a
frame sending it to the router, the router will accept it,
route it based on IP,
and forward it kindly out its interface D to our server at F.
From here, the process can continue.
To summarize,
proxy ARP is a method which permits a machine to answer ARP requests
for other hosts not on the same broadcast network.
Proxy ARP systems then can forward traffic transparently between remote hosts.
Although this solves a few older problems and some case
scenarios like our example IP migration here,
there are, however, some disadvantages to gateway proxy or bridging like this.
Firstly, it increases the overall ARP traffic on your local networks.
Secondly,
proxy ARP clients must maintain larger ARP tables than
they would if properly subnetted.
Next,
it would not work if the proxy device does not know
the location to the remote host,
this can lead to a black hole where data is sent but is never received.
And lastly, security is the largest issue.
Hackers can use the default proxy behavior of a router to access
systems and data that might otherwise be unavailable or hackers can
illegally act as a proxy to intercept packets.
We will look at this and other ARP security related issues in my last module.
Now that you've seen the basic function of proxy ARP in gateway bridging,
let's take a look at some of the more common,
modern, and creative ways proxy ARP can be used.
This case, proxy ARP with NAT is only slightly different from the previous.
Let's say our host at 10.
2.
3 wants to open the Globomantics corporate internal internet web page GMweb.
com.
GMweb.
com is actually running on a server at 172.
18.
2.
143 in a private network isolated behind a firewall, yet DNS has resolved GMweb.
com to 10.
9.
143; therefore, our host routes the traffic through to the router serving the 10.
9.
0 network.
This router then ARPs for 10.
9.
143 and receives the ARP reply from the firewall, the 10.
9.
143 is at the firewall's MAC address C.
Because the firewall handles Network Address Translation for the address 10.
9.
143 to 172.
18.
2.
143 is acting here as the proxy.
It is answering the ARP request for 10.
9.
143 with its own MAC address C.
With this information, the router can forward the packet to the firewall,
from here, the firewall can perform its filtering functions.
If the packet is allowed to pass,
the firewall will perform network address translation and
swap the destination IP addresses and forward the traffic
to the Globomantics web server.
As IP addresses are hidden in this way behind routers
and firewalls acting as NAT agents,
the NAT device must therefore act as proxy and answer for
any of the translated hidden IP addresses.
I should note that this description is not the original form of proxy ARP as
the firewall is not answering ARPs for another system's IP,
but an IP which resides on the firewall itself.
In some firewalls,
proxy ARP does provide ARP replies for requests to
IP addresses behind the firewall.
As well,
many modern firewalls and NAT end points do not require any form of
proxy ARP as they simply route traffic based on IP and perform NAT
as necessary for configured IP ranges.
Because vendor firewall and NAT implementations vary greatly,
it is best to study your own systems through vendor
documentation and labs using protocol analyzers.
Now that you understand that proxy ARP function stands are ARP requests
for and forward traffic to host not on the same LAN,
let's take a look at some interesting server-based variations.
Server hosts running applications and virtual machines will
often use multiple internal networks and IP addresses not
present on the physical network card.
The server will send proxy ARP replies to be able to
bridge traffic from the local network to the internal
applications and virtual machines.
Next,
a proxy ARP server may connect local area network hosts to remote
hosts connected via serial or cable modem connections.
This allows these remote hosts to appear local to the LAN.
Similarly, to facilitate connectivity,
a proxy server may also send ARP replies for remote
VPN connected hosts and end points.
To review,
proxy ARP is when one system or node on a network answers ARP
queries with its own MAC address as a proxy for one or more hosts
which are not on the same local area network.
This is most commonly found on routers,
firewalls with network address translation,
and server systems,
which support applications and virtual machines with different IP addresses,
as well as remote hosts.
Although, proxy ARP is not commonly used to bridge subnet mask differences,
it can be useful in some modern IP migration scenarios.
It is also useful to note that you should check your vendor's
implementation on routers in your business,
it may be on by default and unnecessary,
leading to unexpected forwarding issues and security concerns.
For this reason,
I will show you how to turn proxy ARP off on Cisco
routers in our proxy ARP demonstration.
In the module on ARP related security issues,
you will learn the specific risks and mitigations
associated with proxy ARP and spoofing.
Lastly, proxy ARP, especially if not well understood,
adds complexity and design and difficulty in troubleshooting.
Proxy ARP can lead to a data blackhole if a proxy server answers requests, but does not know how to deliver to that destination.