How does ARP suppression on a BGP EVPN VXLAN VTEP answer ARP requests locally, and which requests still get flooded across the fabric?

## Why ARP is worth suppressing **ARP** requests are broadcast. In a VXLAN segment stretched across many racks, every request for a host's MAC is replicated to every VTEP that serves the VNI and delivered to every host on it, nearly all of which ignore it. RFC 9161 adds a second problem: when a host disappears, some implementations keep retrying ARP for it indefinitely, so the flooding continues for an address nobody owns. A VTEP running **BGP EVPN** already receives the information needed to answer most of those requests: a **MAC/IP Advertisement** (type-2) route can carry a host's IP together with its MAC. RFC 7432 section 10 says that when a VTEP receives an ARP request from a local host and holds the binding for the requested IP, it **SHOULD** perform ARP proxy and reply. **RFC 9161** (Standards Track, 2022) documents the function in detail and calls it **proxy ARP/ND**; "ARP suppression" is the common operational name for the same behaviour. ## Where the bindings come from | Entry kind | Source | Notes | |---|---|---| | Dynamic | snooping ARP (EtherType 0x0806) from local hosts | ARP from remote VTEPs is not snooped | | Static | provisioned by the management system | takes precedence over a learned entry for the same IP | | EVPN-learned | IP and MAC in received type-2 routes | must be created from every valid MAC/IP route | Dynamic entries learned locally are what the VTEP itself advertises in type-2 routes, which is how they become EVPN-learned entries on every other VTEP in the segment. ## The request path 1. A local host sends an ARP request for `10.1.1.20`. 2. The VTEP intercepts it and looks `10.1.1.20` up in its proxy table. 3. **Hit:** it sends an ARP reply carrying the **target host's** MAC, as if the host had answered. The request is not flooded to remote VTEPs or other local hosts. 4. **Miss:** it floods the request to the remote VTEPs of that segment and to its other local hosts, exactly as without suppression. When the owner replies, the binding is learned and advertised, and the next request hits. The reply carries the target's MAC, not the VTEP's: traffic still goes host to host at layer 2, unlike router proxy ARP, where a router answers with its own MAC. ## What still floods - **Misses.** Silent hosts, freshly booted hosts and hosts whose binding aged out. - **Gratuitous ARP and unsolicited Neighbor Advertisements**, which announce moves. - RFC 9161 lets an operator suppress flooding of unknown requests and of gratuitous ARPs separately, but for data centres where fast mobility is expected it says suppressing them is **NOT RECOMMENDED**. Complete suppression suits a network such as an internet exchange point, where every entry can be provisioned statically and nothing moves. ## Keeping the table honest - **Age-time:** a dynamic entry not refreshed by ARP or NA traffic within an administratively chosen age-time is flushed, and its type-2 route withdrawn. - **Send-refresh:** the VTEP may probe a dynamic entry's owner before it ages out, at a third or a half of the age-time per RFC 9161, so an idle but present host is not withdrawn. - **Duplicate-IP detection:** when an IP's MAC changes, the VTEP starts an M-second timer; N moves before it expires declare a duplicate. The defaults in RFC 9161 are **M = 180** seconds and **N = 5**, mirroring RFC 7432's duplicate-MAC check. The VTEP can also send a **confirm** message to the previous owner to catch spoofing quickly. - **Announcing new entries:** RFC 9161 recommends sending a gratuitous ARP or unsolicited NA to local hosts when an EVPN-learned or static entry appears, so host caches stay current. ## IPv6 Neighbor Discovery The same table serves IPv6 as **proxy ND**. Dynamic entries are learned from **Neighbor Advertisements** (ICMPv6 type 136), not from Neighbor Solicitations, because a solicitation lacks the router (R) flag the proxy reply must reproduce. The R and O flags travel to other VTEPs in the ARP/ND extended community on the type-2 route. ## Limits worth stating in an interview - Suppression only works for IPs whose binding some VTEP has learned; it cannot answer for a host that has never spoken. - A host that moves silently leaves a stale entry until aging or a probe corrects it. - Static entries carry an immutable-binding flag so a spoofed ARP cannot overwrite them.