Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is ARP; how does it relate to VIP failover and the Spoofing setting in TR7?
Short answer
ARP (Address Resolution Protocol, RFC 826) is the protocol that finds which MAC address an IP address is at on a local IPv4 network: the device asks "who has this IP?" (ARP request, broadcast), the owner of the address replies with its own MAC, and the device that asked writes this reply to its ARP table; in IPv6, Neighbor Discovery (RFC 4861) does the same job. In TR7, every IP that has been added to an interface and is enabled replies to ARP requests; even if an IP is removed from a vService, it keeps replying unless it is deleted from the interface or disabled (Profile-based IP model). In a cluster, when the VIP moves to the peer device, the device that takes over the VIP sends a gratuitous ARP; this is how switches and neighboring devices learn the new MAC address of the VIP. The Spoofing option, which is turned on together with SNAT = Use Client IP on the Backend Service, on the other hand makes the server replies return through TR7 by performing ARP spoofing on the network where the server is located; the default target is the default gateway of the route table.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Network → Interfaces → right-click on the IP address | Delete IP, Disable for (with the device name) (Right-clicking an IP address) | Stopping an unused address from replying to ARP |
| VIP transition in a cluster | VIP status (such as Slave VIP is active) (Interface and IP statuses) | The device that takes over the VIP sends a gratuitous ARP |
| Backend Service form → Details → SNAT = Use Client IP | Spoofing (off by default), Spoofing IP, in a cluster Spoofing IP VIP Condition and Spoofing Default Device | Pulling the server's replies to TR7 without changing the server's default gateway |
| Network vService → LB Mode = Direct Server Return | Server-side preparation | Configuring the server so that it does not reply to ARP for the vService address (What is Direct Server Return (DSR); what preparation is needed on the server side?) |
The Role of ARP in TR7
- Defined IPs: In TR7, an IP lives on the interface, independently of the vService; as long as it is enabled, it replies to ARP. If an address that another device on the network uses is added to TR7, both devices reply to ARP and an IP conflict occurs.
- VIP transition: The VIP is active on the interface of the device on which it is Master. During the transition, the device that receives the VIP sends a gratuitous ARP; the clients or the gateway do not need to take any additional action. The role and the return of the VIP: What is the Master/Slave role on a VIP?
- Spoofing: When Use Client IP is selected, the server sends the reply to the client's address; for the reply to pass through TR7, either the server's default gateway is set to TR7 or Spoofing is turned on. If Spoofing IP is empty, Spoofing targets the default gateway of the route table. In a cluster, which device performs spoofing is determined by Spoofing IP VIP Condition (the device on which the selected VIP is enabled) or by Spoofing Default Device. Requirements: Is it possible to work without SNAT (transparent mode); what are the requirements?
Common Misconceptions
- "An unused IP is not visible on the network." As long as it stays defined on the interface and enabled, it replies to ARP; an unused address is removed with Delete IP or disabled with Disable for.
- "When the VIP moves, the settings of the clients or of the switch must be changed." The device that takes over the VIP sends a gratuitous ARP; neighboring devices update their ARP tables on their own.
- "Spoofing carries the client IP to the server." It is the Use Client IP option that carries the client IP; Spoofing only makes the replies return to TR7, and it requires TR7 and the server to be on the same L2 network (Do TR7 and the backends have to be on the same L2 network?).
How it is done in the documentation
