arp-proxy

[Jon Otterholm]

The point in all this is to reduce administration on my hand and in some
cases to offer a service to customers with the feeling that they reside
"on the same layer".

Today I'm routing the traffic.

Alcatels soloution to this is to put an ARP-proxy in a Cisco-router. I
cannot understand why Alcatel has put this limitaion in their DSLAM's.
Their answer is that it prevents spoofing. I would accept this as a
feature but not as a limitation... 

/J

On Thu, 2005-11-10 at 13:39 +0000, Brian Candler wrote:
> On Thu, Nov 10, 2005 at 02:25:07PM +0100, Jon Otterholm wrote:
> > In all this - our role is similar to an ISP, but we are buying access to
> > our customers from an external part. Every customer is delivered on a
> > separate vlan trunked. 
> > 
> > - Our DSL customers cannot be set on the same VLAN i a single DSLAM
> > (don't ask me why - ask Alcatel).
> > - We cannot build a simple bridge because the Network service provider
> > can't handle when a MAC-address shows up on 2 different VLAN's.
> > 
> > The arp-proxy should do the following:
> > - Forward any broadcast packets but rewrite src to its own mac.
> > - Forward unicast packets according to FDB but rewrite src to its own
> > mac.
> 
> Can you not perform normal routing - that is, allocate a separate IP subnet
> to each VLAN? This uses some more IPs than a 'flat' addressing space, but
> it's guaranteed to work properly.
> 
> If your DSL traffic is presented as PPPoE, maybe you can get away with just
> having a separate PPPoE listener on each VLAN. If it's presented as L2TP you
> could use private IPs for the tunnel endpoints.
> 
> Otherwise, a bridge which rewrites source MAC addresses as packets pass
> through - that's just too awful to contemplate. As you say, you'd also have
> modify ARP responses to have the bogus MAC addresses too. Dealing with
> multicast, IGMP, Netbios... no I really don't want to contemplate it :-)
> 
> Regards,
> 
> Brian.