1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
|
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip adjust-mss <mss | clamp-mss-to-pmtu>
**Configure the** :abbr:`MSS (Maximum Segment Size)` **advertised in outgoing
TCP SYN packets on the specified interface.**
By clamping the MSS value in TCP SYN packets, you explicitly inform the
remote side not to send packets larger than that size. This prevents
connection issues that occur when Path MTU Discovery (PMTUD) fails.
The following options are available:
* **mss:** Sets the MSS to a specific value, in bytes. Use this option if
you need to enforce a specific MSS, for example, to troubleshoot
connectivity issues or accommodate specific network requirements.
* **clamp-mss-to-pmtu:** The router automatically calculates the MSS to be
the interface's MTU minus 40 bytes for IPv4 traffic (20 bytes for the IPv4
header and 20 bytes for the TCP header). This option is recommended to
automatically set the proper value.
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip arp-cache-timeout
**Configure how long an ARP entry remains valid after learning an IP-to-MAC
address mapping on this interface.**
The default duration is 30 seconds.
An ARP entry remains valid if it receives positive feedback from
higher-level protocols.
Example:
.. code-block:: none
set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip arp-cache-timeout 180
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip disable-arp-filter
**Configure ARP filtering on this interface.**
**Default behavior:** The kernel responds to ARP requests on this interface
only if the traffic would be routed back to the ARP sender through that
specific interface.
**If configured:** The kernel responds to ARP requests on this interface for any
IP address configured on the local host, regardless of which specific interface
that IP address is assigned to, and regardless of the routing table. This
reflects the Linux concept that IP addresses belong to the host, not individual
interfaces.
Example:
.. code-block:: none
set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip disable-arp-filter
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip disable-forwarding
**Configure the interface for host or router behavior.**
If configured, the interface switches to host mode, and IPv4 forwarding is
disabled on it.
Example:
.. code-block:: none
set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip disable-forwarding
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip enable-directed-broadcast
**Configure whether to forward IP-directed broadcast packets received on this
interface.**
**Default behavior:** IP-directed broadcast packets are dropped.
**If configured:** IP-directed broadcast packets are forwarded to all hosts
on the destination subnet, as defined in :rfc:`1812` and :rfc:`2644`.
Example:
.. code-block:: none
set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-directed-broadcast
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip enable-arp-accept
**Configure how to process gratuitous ARPs on this interface.**
If configured, an IP-to-MAC address mapping is added to the ARP table based
on gratuitous ARP requests or replies.
.. note:: If the ARP table already contains the IP address from a gratuitous
ARP, its entry is updated regardless of whether this setting is configured.
Example:
.. code-block:: none
set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-arp-accept
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip enable-arp-announce
**Configure the source IP selection for ARP requests on this interface.**
**Default behavior:** The kernel can use any IP address the host owns as
the source IP address in ARP requests on this interface.
**If configured:** The kernel first attempts to select a source IP address
configured on the interface that shares a common subnet with the target
IP address. If there is no such subnet, the kernel selects the IP address
it would normally use (based on the routing table to reach the target
destination).
Example:
.. code-block:: none
set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-arp-announce
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip enable-arp-ignore
**Configure which ARP requests will be ignored on this interface.**
**Default behavior:** The kernel responds to ARP requests for any local
IP addresses, regardless of which interface they are assigned to.
**If configured:** The kernel responds to ARP requests only if the target
IP address is assigned to this specific interface.
Example:
.. code-block:: none
set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-arp-ignore
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip enable-proxy-arp
**Configure proxy ARP on this interface.**
If configured, the router (kernel) intercepts ARP requests for non-local IP
addresses and replies with the :abbr:`MAC (Media Access Control)` address
of the interface that received the request. Subsequent packets destined
to these IP addresses are forwarded to their actual destinations on remote
subnets.
Example:
.. code-block:: none
set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-proxy-arp
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip proxy-arp-pvlan
**Configure local proxy ARP on the interface.**
If configured, the router (kernel) responds to ARP requests on this VLAN
interface even if the target IP address resides on the same subnet and
interface.
This is used to support network isolation requirements (RFC 3069) for private
VLANs (PVLANs). In PVLAN configurations, hosts on isolated ports are NOT
allowed to communicate directly with each other at Layer 2, but they can
communicate with the upstream router.
By replying to inter-host ARP requests with its own :abbr:`MAC (Media Access Control)`
address, the router (kernel) directs inter-host traffic through itself instead of
directly between hosts.
.. note:: This command works independently and does not require enabling
the standard proxy ARP on the interface.
Local proxy ARP is also known as:
- VLAN aggregation (:rfc:`3069`).
- Private VLAN (Cisco, Allied Telesyn).
- Source-port filtering or port isolation (Hewlett-Packard).
- MAC-Forced Forwarding (Ericsson).
.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
{{ var5 }} {{ var6 }} ip source-validation <strict | loose | disable>
**Configure source IP address validation using** :abbr:`RPF (Reverse Path
Forwarding)` **on this interface, as specified in** :rfc:`3704`.
The following options are available:
- **strict:** Each incoming packet’s source IP address is checked against the
Forwarding Information Base (FIB). If the interface is not the best route
back to that source, validation fails, and the packet is dropped.
- **loose:** Each incoming packet’s source IP address is checked against the
FIB. If the source IP address is unreachable through any interface, validation
fails.
- **disable:** No source IP address validation is performed. All incoming
packets are accepted.
RFC 3704 recommends enabling strict mode to prevent IP spoofing, such as
DDoS attacks. For asymmetric or other complex routing scenarios, use loose
mode.
|
