What does ARP suppression do in an EVPN fabric?
Show the answer
Say this first
The leaf builds a cache of IP-to-MAC bindings from EVPN type 2 MAC+IP routes. When a local host ARPs for an IP the leaf already knows, the leaf replies itself instead of flooding the request to every VTEP in the VNI. Requests for unknown targets are still flooded. It cuts BUM traffic, which matters most with ingress replication.
Go deeper
Flow
- SRV2 on LEAF2 sends its first packet. LEAF2 learns its MAC and IP and advertises a type 2 MAC+IP route.
- LEAF1 installs 10.10.10.12 at 0050.56a1.0012 in its suppression cache.
- SRV1 on LEAF1 ARPs for 10.10.10.12. LEAF1 answers locally. Nothing crosses the fabric.
Config and checks
interface nve1
member vni 10010
suppress-arpshow ip arp suppression-cache detail lists local (L) and remote (R) entries. On some older Nexus 9000
hardware ARP suppression needs a TCAM region carved first, which takes a reload. IPv6 has the same idea
for neighbor discovery.
Limits
- A silent host has no entry, so the first ARP for it is flooded. That is normal.
- DHCP and other broadcasts are untouched.
They will ask next
Does ARP suppression help hosts reach their gateway?
Not much. With an anycast gateway the local leaf owns the gateway IP and answers that ARP anyway. Suppression matters for hosts in the same subnet on different leaves.
Traps
- Claiming ARP suppression removes all broadcast traffic.