.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip adjust-mss <mss | clamp-mss-to-pmtu>

  **Configure the** :abbr:`MSS (Maximum Segment Size)` **advertised in outgoing 
  TCP SYN packets on the specified interface.** 

  By clamping the MSS value in TCP SYN packets, you explicitly inform the 
  remote side not to send packets larger than that size. This prevents 
  connection issues that occur when Path MTU Discovery (PMTUD) fails.

  The following options are available:

  * **mss:** Sets the MSS to a specific value, in bytes. Use this option if 
    you need to enforce a specific MSS, for example, to troubleshoot 
    connectivity issues or accommodate specific network requirements.
  * **clamp-mss-to-pmtu:** The router automatically calculates the MSS to be 
    the interface's MTU minus 40 bytes for IPv4 traffic (20 bytes for the IPv4 
    header and 20 bytes for the TCP header). This option is recommended to 
    automatically set the proper value.


.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip arp-cache-timeout

  **Configure how long an ARP entry remains valid after learning an IP-to-MAC 
  address mapping on this interface.** 

  The default duration is 30 seconds.

  An ARP entry remains valid if it receives positive feedback from 
  higher-level protocols.

  Example:

  .. code-block:: none

    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip arp-cache-timeout 180

.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip disable-arp-filter

  **Configure ARP filtering on this interface.**

  **Default behavior:** The kernel responds to ARP requests on this interface 
  only if the traffic would be routed back to the ARP sender through that 
  specific interface. 

  **If configured:** The kernel responds to ARP requests on this interface for any 
  IP address configured on the local host, regardless of which specific interface 
  that IP address is assigned to, and regardless of the routing table. This 
  reflects the Linux concept that IP addresses belong to the host, not individual 
  interfaces.  

  Example:

  .. code-block:: none

    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip disable-arp-filter

.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip disable-forwarding

  **Configure the interface for host or router behavior.**

  If configured, the interface switches to host mode, and IPv4 forwarding is 
  disabled on it.

  Example:

  .. code-block:: none

    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip disable-forwarding

.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip enable-directed-broadcast

  **Configure whether to forward IP-directed broadcast packets received on this 
  interface.** 
  
  **Default behavior:** IP-directed broadcast packets are dropped. 

  **If configured:** IP-directed broadcast packets are forwarded to all hosts 
  on the destination subnet, as defined in :rfc:`1812` and :rfc:`2644`.  

  Example:

  .. code-block:: none

    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-directed-broadcast

.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip enable-arp-accept

  **Configure how to process gratuitous ARPs on this interface.**

  If configured, an IP-to-MAC address mapping is added to the ARP table based 
  on gratuitous ARP requests or replies.

  .. note:: If the ARP table already contains the IP address from a gratuitous 
     ARP, its entry is updated regardless of whether this setting is configured.

  Example:

  .. code-block:: none

    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-arp-accept

.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip enable-arp-announce

  **Configure the source IP selection for ARP requests on this interface.**

  **Default behavior:** The kernel can use any IP address the host owns as 
  the source IP address in ARP requests on this interface.

  **If configured:** The kernel first attempts to select a source IP address 
  configured on the interface that shares a common subnet with the target 
  IP address. If there is no such subnet, the kernel selects the IP address 
  it would normally use (based on the routing table to reach the target 
  destination).

  Example:

  .. code-block:: none

    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-arp-announce

.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip enable-arp-ignore

  **Configure which ARP requests will be ignored on this interface.**

  **Default behavior:** The kernel responds to ARP requests for any local 
  IP addresses, regardless of which interface they are assigned to.

  **If configured:** The kernel responds to ARP requests only if the target 
  IP address is assigned to this specific interface.

  Example:

  .. code-block:: none

    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-arp-ignore

.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip enable-proxy-arp

  **Configure proxy ARP on this interface.**

  If configured, the router (kernel) intercepts ARP requests for non-local IP 
  addresses and replies with the :abbr:`MAC (Media Access Control)` address 
  of the interface that received the request. Subsequent packets destined 
  to these IP addresses are forwarded to their actual destinations on remote 
  subnets.

  Example:

  .. code-block:: none

    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-proxy-arp

.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip proxy-arp-pvlan

  **Configure local proxy ARP on the interface.**

  If configured, the router (kernel) responds to ARP requests on this VLAN 
  interface even if the target IP address resides on the same subnet and 
  interface.

  This is used to support network isolation requirements (RFC 3069) for private 
  VLANs (PVLANs). In PVLAN configurations, hosts on isolated ports are NOT 
  allowed to communicate directly with each other at Layer 2, but they can 
  communicate with the upstream router. 

  By replying to inter-host ARP requests with its own :abbr:`MAC (Media Access Control)` 
  address, the router (kernel) directs inter-host traffic through itself instead of 
  directly between hosts.

  .. note:: This command works independently and does not require enabling 
     the standard proxy ARP on the interface.

  Local proxy ARP is also known as:

  - VLAN aggregation (:rfc:`3069`).

  - Private VLAN  (Cisco, Allied Telesyn).

  - Source-port filtering or port isolation (Hewlett-Packard).

  - MAC-Forced Forwarding (Ericsson).

.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
  {{ var5 }} {{ var6 }} ip source-validation <strict | loose | disable>

  **Configure source IP address validation using** :abbr:`RPF (Reverse Path 
  Forwarding)` **on this interface, as specified in** :rfc:`3704`. 

  The following options are available:

  - **strict:** Each incoming packet’s source IP address is checked against the 
    Forwarding Information Base (FIB). If the interface is not the best route 
    back to that source, validation fails, and the packet is dropped.

  - **loose:** Each incoming packet’s source IP address is checked against the 
    FIB. If the source IP address is unreachable through any interface, validation 
    fails.

  - **disable:** No source IP address validation is performed. All incoming 
    packets are accepted.

  RFC 3704 recommends enabling strict mode to prevent IP spoofing, such as 
  DDoS attacks. For asymmetric or other complex routing scenarios, use loose 
  mode.