local-proxy-arp is useful when you have some old IP cameras with broken IP stacks(reolink). On a reboot the cameras work for a few hours/days but will eventually not reply to arp on the same broadcast domain. Setting local-proxy-arp on the router vlan interface for that subnet allows for it to always work.
I got in my mind that way: proxy-arp works not between devices in the same l2-segment, but needs a entry in the routing table to work. local-proxy-arp works like a proxy in the l2-segment. every arp-request is answered by the router (regardless of the routing table entries). the combination with horizon is new to me.
If what you mean by l2-segment is the broadcast domain then you got it correct that proxy-arp is not the same broadcast domain, but there is no entry in the routing table needed. Same in the local-proxy case, devices are not in the same broadcast domain - they cannot send layer2 frames directly to each other, they can only do layer3 communication.
Good question. Can't say from experience, but I imagine if some hosts like to spam a lot of broadcast messages or you are worried about a potential layer2 attack, you could solve it that way.
When you want to isolate users from each other, but you don't want or need the additional overhead and complexity of individual routed or VLAN segment. I.e. a student campus network. You don't want a student plugging in the LAN port of a router into the wall socket and flooding DHCP everywhere, or a printer/TV/whatever and having it visible to all other rooms. If there are 500 rooms, you would then need to create 500 VLAN's. Or you can simply use horizon (or port isolation) to prevent any cross talk between rooms and get away with a single VLAN and subnet. A heck of a lot cleaner and simpler
Прикольно. Выглядит довольно олдскульно, как артефакты ушедшей цивилизации :) Сейчас стандартный путь - роутинг, маршрутизаторы, BGP и вот это вот всё.
Mikrotik, i still can't understand why do think that arp reply and learning modes shuold be combined in one place ... they must by separate as all big players do. Because there are cases then you don't want to dynamically learn arp, but want to proxy it.
Could you please elaborate on the use case for arp-proxy without ARP learning? ARP proxy is very rarely used as it is already, this seems like even more niche requirement that can already be satisfied using other RouterOS features.
@@mikrotik Access network with Split horizon bridging/Private VLAN/Client Isolation (call it as you want) and DHCP Server with "Add arp for leases" combination requires disabled ARP learning and enabled local-proxy-arp (to keep communication between devices in same bridge domain). This problem was posted many times in your forum. Today it's possible to solve this problem only with bridge filtering (requires wasting extra resources), but it only work's when vlan's are not involved, because if you implement bridge with vlan support, you can't filter packets by parameters witch are VLAN tagged.
local-proxy-arp is useful when you have some old IP cameras with broken IP stacks(reolink). On a reboot the cameras work for a few hours/days but will eventually not reply to arp on the same broadcast domain. Setting local-proxy-arp on the router vlan interface for that subnet allows for it to always work.
Finally understand the difference between proxy-arp and local-proxy-arp, thank you!
Since the bootcamp in Riga, I have really understood the functions. 🙂
most interesting arp trickery. IDK if I ever use it, but it is nice to learn. Thank you.
I like the "prnt" at 4:40. Very realistic.
time well spent mate, thx for the explanation!
Thanks ALOT for your effort, sure made it MUCH easier to troubleshoot badly configured setups for me
Thanks for putting your time and effort into this video, it was not a waste of time!
Glad it was helpful!
I loved the depth of this video :)
thanks. some clearance to ARP trickery on rOS
looking forward to new VLAN videos
I got in my mind that way: proxy-arp works not between devices in the same l2-segment, but needs a entry in the routing table to work. local-proxy-arp works like a proxy in the l2-segment. every arp-request is answered by the router (regardless of the routing table entries). the combination with horizon is new to me.
If what you mean by l2-segment is the broadcast domain then you got it correct that proxy-arp is not the same broadcast domain, but there is no entry in the routing table needed. Same in the local-proxy case, devices are not in the same broadcast domain - they cannot send layer2 frames directly to each other, they can only do layer3 communication.
Time well spent!
Why is it useful to have network (bridged) members not sharing a broadcast domain?
Good question. Can't say from experience, but I imagine if some hosts like to spam a lot of broadcast messages or you are worried about a potential layer2 attack, you could solve it that way.
@@RB01-lite like in unicast mode? gotta research this one
When you want to isolate users from each other, but you don't want or need the additional overhead and complexity of individual routed or VLAN segment. I.e. a student campus network. You don't want a student plugging in the LAN port of a router into the wall socket and flooding DHCP everywhere, or a printer/TV/whatever and having it visible to all other rooms. If there are 500 rooms, you would then need to create 500 VLAN's. Or you can simply use horizon (or port isolation) to prevent any cross talk between rooms and get away with a single VLAN and subnet. A heck of a lot cleaner and simpler
@@aidangillett5396 makes sense, like a campus network where clients shouldn't be communicating with one another
Прикольно. Выглядит довольно олдскульно, как артефакты ушедшей цивилизации :)
Сейчас стандартный путь - роутинг, маршрутизаторы, BGP и вот это вот всё.
Mikrotik, i still can't understand why do think that arp reply and learning modes shuold be combined in one place ... they must by separate as all big players do. Because there are cases then you don't want to dynamically learn arp, but want to proxy it.
Could you please elaborate on the use case for arp-proxy without ARP learning? ARP proxy is very rarely used as it is already, this seems like even more niche requirement that can already be satisfied using other RouterOS features.
@@mikrotik Access network with Split horizon bridging/Private VLAN/Client Isolation (call it as you want) and DHCP Server with "Add arp for leases" combination requires disabled ARP learning and enabled local-proxy-arp (to keep communication between devices in same bridge domain). This problem was posted many times in your forum. Today it's possible to solve this problem only with bridge filtering (requires wasting extra resources), but it only work's when vlan's are not involved, because if you implement bridge with vlan support, you can't filter packets by parameters witch are VLAN tagged.
replay onley doesnt work even i set up add leases for arp in dhcp server for hotspot clients
Class A access... 😏