Tuesday, June 14, 2011

Proxy ARP

A proxy ARP enabled device allows hosts that reside on different subnets to communicate.
As shown in Figure Router connects to two subnets through Vlan-interface1 and Vlan-interface2.
The IP addresses of the two interfaces are 192.168.10.99/24 and 192.168.20.99/24. Host A and Host
B have the same prefix 192.168.0.0 assigned and connect to Vlan-interface1 and Vlan-interface2,
respectively..







Application environment of proxy ARP
Because Host A considers that Host B is on the same network, it directly sends an ARP request for the
MAC address of Host B. Host B, however, cannot receive this request because it locates in a different
broadcast domain.



You can solve the problem by enabling proxy ARP on Switch. After that, Switch can reply to the ARP
request from Host A with the MAC address of Vlan-interface1, and forward packets sent from Host A to
Host B. In this case, Switch seems like a proxy of Host B.
A main advantage of proxy ARP is that it is added on a single Switch without disturbing routing tables
of other Switchs in the network. Proxy ARP acts as the gateway for IP hosts that are not configured
with a default gateway or do not have routing capability.


Configuration Sample


# Specify the IP address of interface VLAN-interface 1.

[Switch] interface vlan-interface 1
[Switch-Vlan-interface1] ip address 192.168.10.99 255.255.255.0

# Enable proxy ARP on interface VLAN-interface 1.

[Switch-Vlan-interface1] proxy-arp enable   Under vlan
[Switch-Vlan-interface1] quit

# Specify the IP address of interface VLAN-interface 2.

[Switch] interface vlan-interface 2
[Switch-Vlan-interface2] ip address 192.168.20.99 255.255.255.0

# Enable proxy ARP on interface VLAN-interface 2.proxy-arp enable on vlan interface

[Switch-Vlan-interface2] proxy-arp enable

After completing preceding configurations, use the ping command to verify the connectivity between
Host A and Host B.







Optimization of fortigate IPS

IPS signature need select according to infrastructure environment  Eg:-  if  we are not have Linux servers this ips signature can disable (d...