Чуть-чуть о Proxy ARP

Итак, например, была такая дебильная топология:Proxy_ARP_1В ней в качестве граничного устройства для ЛВС работала ASA, которая напрямую смотрела в сеть провайдера и имела адрес внешнего интерфейса 198.51.100.2/30. Ну и была какая-то ЛВС, в которой был какой-то вебсервер с IP 10.200.0.100/24. Еще ASA транслировала весь трафик пользователей, вылетающий наружу в IP 198.51.100.2, т.к. это был единственный публичный IP, предоставленный провайдером.

И вдруг провайдер расщедрился и подарил нам целый блок публичных адресов, скажем 203.0.113.0/24, причем подарил так, что весь этот блок для провайдера висит на том же интерфейсе, на котором висит и маааленькая подсеть 198.51.100.0/30 — та же, куда воткнута и ASA.

Proxy_ARP_Cisco_ASA

И после этого нам захотелось предоставить доступ пользователям из интернета к нашему вебсерверу, да причем предоставить так, чтобы он был доступен для них по IP 203.0.113.100. Ну и мы не пытаясь найти более логичных решений просто прописываем на ASA такое правило NAT/PAT (ну и немного сопутствующей конфигурации):

Теперь, Source IP всех пакетов, которые идут от сервера и вылетают наружу через внешний интерфейс ASA заменяются с 10.200.0.100 на 203.0.113.100 и наоборот, пакеты прилетающие на внешний интерфейс ASA из Интернета с Destination IP 203.0.113.100, получают новый Destination IP 10.200.0.100. Ну и дальше по теме.

Proxy ARP

Посмотрим детальнее. Итак, некто в интернете открыл ввел в адресной строке адрес http://203.0.113.100. Пакет долетел до нашего ISP, который владеет этим адресом и попал на интерфейс, который смотрит в сторону ASA. Самому интерфейсу маршрутизатора провайдера в этой подсети присвоен адрес 203.0.113.1 с маской 24. Соответственно, ISP роутер знает, что для него эта подсеть является directly connected и маршрутизация для него закончилась. Ему нужно просто отправить пакет адресату, т.е. 203.0.113.100. Что он делает? Он просто отправляет в эту подсеть (т.е. через свой интерфейс, смотрящий на нашу ASA) ARP-запрос, спрашивая, кому принадлежит 203.0.113.100. Ну и тут за дело берется тот самый прокси-ARP. Внешнему интерфейсу ASA присвоен IP 198.51.100.2, но никак ни 203.0.113.100. Но, за счет того, что на ASA настроено приведенное выше правило трансляции адресов и proxy-ARP включен (что есть по умолчанию), она, видя этот ARP запрос от роутера ISP отвечает: «IP 203.0.113.100 — мой и вот мой mac-адрес: ed22:0031:3212. Давай шли сюда что там у тебя есть». После этого маршрутизатор ISP плагополучно отправляет пакет в свой линк, смотрящий на ASA, та выполняет обратную трансляцию адреса и пакет долетает до вебсервера. Все отлично.

Здесь пример может быть не самый практический, но суть передавать должен. Кстати, даже если внешнему интерфейсу присвоить IP из нового блока адресов, например 203.0.113.2, а все адреса внутренних клиентов транслировать в другой IP из этой же подсети, скажем 203.0.113.10, то при общении с роутером ISP также будет задействоваться proxy-arp, т.к. опять же, IP 203.0.113.10 интерфейсу не принадлежит, а на arp запросы по этому адресу ASA отвечает.

Как было сказно выше на ASA 8.3+ прокси ARP включен по умолчанию:

Соответственно, когда бывает необходимость его выключить (пока не сталкивался с такой необходимостью), достаточно ввести sysopt noproxyarp с указанием интерфейса. Но, перед этим, нужно обязательно смотреть на правила NAT, висящие на этих интерфейсах, дабы их не убить.

Чуть позже допишу, если не забуду.


Не забывайте оставлять комментарии, если пост был вам полезен!
Опубликовано в Сети Метки: , ,
0 comments on “Чуть-чуть о Proxy ARP
64 Пинги/Обратные ссылки для "Чуть-чуть о Proxy ARP"
  1. Google

    Below you will discover the link to some web pages that we believe you ought to visit.

  2. Raw Food Chef Training

    […]Sites of interest we’ve a link to[…]

  3. Bursa Saham Indonesia

    […]check below, are some totally unrelated internet sites to ours, nonetheless, they’re most trustworthy sources that we use[…]

  4. Trader Saham Indonesia

    […]always a huge fan of linking to bloggers that I love but really don’t get a great deal of link really like from[…]

  5. cursos online

    […]check beneath, are some entirely unrelated web-sites to ours, even so, they are most trustworthy sources that we use[…]

  6. xnnx:

    xnnx

    […]Sites of interest we have a link to[…]

  7. fbvcursos

    […]we prefer to honor a lot of other world-wide-web sites on the web, even though they aren’t linked to us, by linking to them. Under are some webpages worth checking out[…]

  8. engineering staff augmentation services

    […]here are some hyperlinks to sites that we link to mainly because we feel they are really worth visiting[…]

  9. Criminal Defense Lawyer Greenville, SC

    […]one of our guests just lately encouraged the following website[…]

  10. Nail Salons In Scottsdale

    […]Every as soon as inside a although we choose blogs that we read. Listed beneath would be the most recent web pages that we opt for […]

  11. male masturbator

    […]The data mentioned within the article are several of the ideal obtainable […]

  12. vibrator for women

    […]The information mentioned in the report are a number of the most effective available […]

  13. fretboard

    […]always a significant fan of linking to bloggers that I appreciate but really don’t get quite a bit of link love from[…]

  14. Giraffe birth

    […]the time to study or go to the subject material or websites we have linked to below the[…]

  15. Third Party Manufacturing In Manipur

    […]we came across a cool web-site that you could take pleasure in. Take a appear for those who want[…]

  16. Penis pumps

    […]Every after in a while we pick blogs that we study. Listed beneath are the newest internet sites that we choose […]

  17. Nintendo subscription box

    […]Here is a superb Weblog You may Locate Interesting that we Encourage You[…]

  18. Clit vibrator review

    […]Here are a number of the web sites we suggest for our visitors[…]

  19. How to use g spot vibrator

    […]Sites of interest we’ve a link to[…]

  20. Magic wand massager

    […]Here is an excellent Weblog You might Locate Intriguing that we Encourage You[…]

  21. Best couples vibrator

    […]very couple of internet websites that transpire to become in depth beneath, from our point of view are undoubtedly properly worth checking out[…]

  22. Realistic vibrator

    […]Sites of interest we’ve a link to[…]

  23. Ingeniería en Informática en Cantabria

    […]please check out the web pages we adhere to, including this 1, because it represents our picks from the web[…]

  24. Essay «How Do I Identify Myself And Why» — Grade A

    […]Sites of interest we have a link to[…]

  25. apunts 5112

    […]the time to study or take a look at the content or web pages we’ve linked to below the[…]

  26. Summary. English. Short summary. Juridical notions

    […]usually posts some quite intriguing stuff like this. If you are new to this site[…]

  27. camping equipment

    […]Wonderful story, reckoned we could combine a few unrelated information, nonetheless really really worth taking a look, whoa did a single understand about Mid East has got more problerms too […]

  28. bed restraint kit

    […]usually posts some extremely intriguing stuff like this. If you’re new to this site[…]

  29. 토토사이트

    […]Wonderful story, reckoned we could combine a number of unrelated data, nonetheless seriously worth taking a search, whoa did a single study about Mid East has got additional problerms too […]

  30. Best anal vibrators

    […]The information mentioned within the article are some of the most effective readily available […]

  31. Sample%2Fpractice Exam 2015. Questions And Answers

    […]always a huge fan of linking to bloggers that I really like but don’t get a lot of link love from[…]

  32. Food coupons

    […]here are some hyperlinks to sites that we link to for the reason that we feel they may be really worth visiting[…]

  33. best ben wa balls

    […]The data mentioned inside the post are several of the best available […]

  34. Jkssb Selection list

    […]please pay a visit to the web pages we comply with, including this one particular, as it represents our picks through the web[…]

  35. dual stimulating vibrator

    […]Here are a number of the web sites we recommend for our visitors[…]

  36. Lego architecture — 21028 new york city

    […]check below, are some completely unrelated websites to ours, having said that, they may be most trustworthy sources that we use[…]

  37. FIFA 19 Coins

    […]one of our guests recently encouraged the following website[…]

  38. flexible vibrator

    […]The information and facts mentioned within the report are several of the best readily available […]

  39. body wand personal massager

    […]Here are some of the sites we recommend for our visitors[…]

  40. guitar vibrato

    […]that could be the end of this report. Here you will uncover some web sites that we think you will appreciate, just click the links over[…]

  41. mini bullet sex toy

    […]Here is an excellent Blog You may Locate Exciting that we Encourage You[…]

  42. how to find the g spot

    […]here are some links to websites that we link to because we consider they are really worth visiting[…]

  43. realistic suction cup dildo

    […]we prefer to honor numerous other internet web pages around the internet, even if they aren’t linked to us, by linking to them. Underneath are some webpages worth checking out[…]

  44. evolved wild orchid vibrator

    […]please check out the sites we follow, which includes this 1, because it represents our picks in the web[…]

  45. gay anal vibrator

    […]just beneath, are a lot of completely not connected websites to ours, nevertheless, they may be surely worth going over[…]

  46. Porn City XXX

    […]Wonderful story, reckoned we could combine a number of unrelated data, nonetheless actually really worth taking a appear, whoa did one discover about Mid East has got a lot more problerms as well […]

  47. vibrating panty

    […]The info mentioned inside the post are some of the most beneficial accessible […]

  48. warm prostate vibrator

    […]Sites of interest we’ve a link to[…]

  49. cyberskin dildo

    […]here are some links to internet sites that we link to due to the fact we think they’re really worth visiting[…]

  50. Check Here

    […]always a major fan of linking to bloggers that I love but do not get a great deal of link adore from[…]

  51. brake and clutch montague gardens

    […]usually posts some pretty exciting stuff like this. If you are new to this site[…]

  52. https://find-a-bride.org/

    […]The information and facts mentioned in the post are some of the top obtainable […]

  53. how to make good money

    […]usually posts some really interesting stuff like this. If you are new to this site[…]

  54. detroit seo

    […]very handful of sites that occur to become in depth below, from our point of view are undoubtedly nicely really worth checking out[…]

  55. teen xxx

    […]just beneath, are many totally not connected web pages to ours, on the other hand, they are certainly worth going over[…]

  56. can i get home

    […]The information and facts talked about inside the article are a few of the most effective offered […]

  57. adam and eve ravishing rabbit thruster

    […]check below, are some totally unrelated internet sites to ours, even so, they’re most trustworthy sources that we use[…]

  58. best anal sex toys

    […]Every as soon as inside a when we pick blogs that we study. Listed beneath would be the newest web-sites that we choose […]

  59. Free:

    Free

    […]The facts talked about within the report are some of the most beneficial readily available […]

  60. penis enlarger

    […]Wonderful story, reckoned we could combine a few unrelated information, nevertheless definitely really worth taking a look, whoa did a single master about Mid East has got extra problerms at the same time […]

  61. butt plug

    […]although internet sites we backlink to below are considerably not related to ours, we feel they’re in fact really worth a go as a result of, so have a look[…]

  62. adam and eve vibrating kegel balls

    […]Here is a great Blog You may Discover Exciting that we Encourage You[…]

  63. vibrating strap on for couples

    […]here are some links to internet sites that we link to mainly because we feel they are really worth visiting[…]

Заодно посмотрите мои фоты в моем профиле вконтакте. Любые вопросы по существу статей можете задать там же.
Hostenko — лучший WordPress-хостинг