ARP

ARP (Address Resolution Protocol) configuration manages IP-to-MAC address resolution behavior on NX-OS devices, including global timeout, cache size limits, per-interface cache limits, and syslog rate controls for cache events. It supports advanced features such as adjacency route distance tuning, EVPN timeout settings for overlay environments, ARP suppression timeout, static ARP entries outside subnets, and RARP fabric forwarding for VXLAN deployments. ARP also provides vPC domain-level ARP synchronization to ensure consistent address resolution across vPC peer switches, along with CoS marking and off-list timeout configuration for fine-grained operational control. Dynamic ARP Inspection (DAI) can be configured to validate ARP packets for source, destination, and IP address checks with configurable log buffer sizes, enabled per VLAN with optional DHCP binding logging (requires the arp-ether TCAM region), and Layer 2 Ethernet and port-channel interfaces can be marked as DAI trusted.

ARP (Address Resolution Protocol) configuration manages IP-to-MAC address resolution behavior on NX-OS devices, including global timeout, cache size limits, per-interface cache limits, and syslog rate controls for cache events. It supports advanced features such as adjacency route distance tuning, EVPN timeout settings for overlay environments, ARP suppression timeout, static ARP entries outside subnets, and RARP fabric forwarding for VXLAN deployments. ARP also provides vPC domain-level ARP synchronization to ensure consistent address resolution across vPC peer switches, along with CoS marking and off-list timeout configuration for fine-grained operational control. Dynamic ARP Inspection (DAI) can be configured to validate ARP packets for source, destination, and IP address checks with configurable log buffer sizes.

Diagram

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
arp	Class	arp	No

arp (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
inspection	Class	inspection	No
timeout	Integer	min: 0, max: 28800	No
cache_limit	Integer	min: 1, max: 614400	No
cache_syslog_rate	Integer	min: 1, max: 1000	No
cache_intf_limit	Integer	min: 0, max: 128000	No
adjacency_route_distance	Integer	min: 2, max: 250	No
cos	Integer	min: 0, max: 7	No
off_list_timeout	Integer	min: 180, max: 1800	No
evpn_timeout	Integer	min: 2000, max: 30000	No
suppression_timeout	Integer	min: 0, max: 28800	No
allow_static_arp_outside_subnet	Boolean	true, false	No
unnum_svi_sw_replication	Boolean	true, false	No
rarp_fabric_forwarding	Boolean	true, false	No
rarp_fabric_forwarding_rate_limit	Integer	min: 200, max: 400	No
outside_subnet	Boolean	true, false	No
inspection	Class	inspection	No

inspection (nxos.devices.configuration.arp)

Name	Type	Constraint	Mandatory	Default Value
log_buffer_entries	Integer	min: 1, max: 1024	No
validate_dst_mac	Boolean	true, false	No
validate_ip	Boolean	true, false	No
validate_src_mac	Boolean	true, false	No
vlans	List	vlans	No
log_buffer_entries	Integer	min: 1, max: 1024	No
validate_dst_mac	Boolean	true, false	No
validate_ip	Boolean	true, false	No
validate_src_mac	Boolean	true, false	No
vlans	List	vlans	No

inspection (nxos.devices.configuration.arp)

Name	Type	Constraint	Mandatory	Default Value
log_buffer_entries	Integer	min: 1, max: 1024	No
validate_dst_mac	Boolean	true, false	No
validate_ip	Boolean	true, false	No
validate_src_mac	Boolean	true, false	No
log_buffer_entries	Integer	min: 1, max: 1024	No
validate_dst_mac	Boolean	true, false	No
validate_ip	Boolean	true, false	No
validate_src_mac	Boolean	true, false	No

vlans (nxos.devices.configuration.arp.inspection)

Name	Type	Constraint	Mandatory	Default Value
vlans	Class	vlans	Yes
logging_dhcp_bindings	Choice	permit, all, none	No
vlans	Class	vlans	Yes
logging_dhcp_bindings	Choice	permit, all, none	No

vlans (nxos.devices.configuration.arp.inspection.vlans)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

ranges (nxos.devices.configuration.arp.inspection.vlans.vlans)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: 1, max: 4094	Yes
to	Integer	min: 1, max: 4094	Yes
from	Integer	min: 1, max: 4094	Yes
to	Integer	min: 1, max: 4094	Yes

Examples

Example 1: Basic ARP tuning for a leaf switch with increased cache and timeout

nxos:
  devices:
    - name: LEAF1
      configuration:
        arp:
          timeout: 1500
          cache_limit: 131072
          cache_syslog_rate: 100

Example 2: ARP optimized for VXLAN/EVPN fabric with suppression and vPC sync

nxos:
  devices:
    - name: LEAF1
      configuration:
        arp:
          timeout: 1500
          cache_limit: 131072
          cache_intf_limit: 32000
          evpn_timeout: 10000
          suppression_timeout: 300
          rarp_fabric_forwarding: true
          rarp_fabric_forwarding_rate_limit: 300

Example 3: Advanced ARP configuration with adjacency tuning and off-list controls

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        arp:
          timeout: 1200
          cache_limit: 262144
          cache_intf_limit: 64000
          cache_syslog_rate: 50
          adjacency_route_distance: 200
          cos: 6
          off_list_timeout: 600
          evpn_timeout: 15000
          allow_static_arp_outside_subnet: true
          outside_subnet: true

Example 4: Dynamic ARP Inspection (DAI) with validation and logging

nxos:
  devices:
    - name: ACCESS-LEAF1
      configuration:
        arp:
          inspection:
            log_buffer_entries: 64
            validate_dst_mac: true
            validate_ip: true
            validate_src_mac: true

Example 5: DAI enabled on access VLANs with DHCP binding logging and a trusted uplink

nxos:
  devices:
    - name: ACCESS-LEAF1
      configuration:
        arp:
          inspection:
            validate_src_mac: true
            vlans:
              - vlans:
                  ids: [10, 20]
              - vlans:
                  ranges:
                    - from: 100
                      to: 110
                logging_dhcp_bindings: permit
        interfaces:
          port_channels:
            - id: 1
              ip:
                arp_inspection_trust: true

Examples

Example 1: Basic ARP tuning for a leaf switch with increased cache and timeout

nxos:
  devices:
    - name: LEAF1
      configuration:
        arp:
          timeout: 1500
          cache_limit: 131072
          cache_syslog_rate: 100

Example 2: ARP optimized for VXLAN/EVPN fabric with suppression and vPC sync

nxos:
  devices:
    - name: LEAF1
      configuration:
        arp:
          timeout: 1500
          cache_limit: 131072
          cache_intf_limit: 32000
          evpn_timeout: 10000
          suppression_timeout: 300
          rarp_fabric_forwarding: true
          rarp_fabric_forwarding_rate_limit: 300

Example 3: Advanced ARP configuration with adjacency tuning and off-list controls

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        arp:
          timeout: 1200
          cache_limit: 262144
          cache_intf_limit: 64000
          cache_syslog_rate: 50
          adjacency_route_distance: 200
          cos: 6
          off_list_timeout: 600
          evpn_timeout: 15000
          allow_static_arp_outside_subnet: true
          outside_subnet: true

Example 4: Dynamic ARP Inspection (DAI) with validation and logging

nxos:
  devices:
    - name: ACCESS-LEAF1
      configuration:
        arp:
          inspection:
            log_buffer_entries: 64
            validate_dst_mac: true
            validate_ip: true
            validate_src_mac: true