Someone configured ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 with no next hop. What is wrong with that?
Show the answer
Say this first
Pointing a route only at an Ethernet interface tells the router that every destination is directly on that segment. So it sends an ARP request for each destination address, and it only works because the upstream router answers with proxy ARP. The ARP table and the CEF adjacency table grow by one entry per remote host, and the day the upstream turns proxy ARP off, traffic stops. Add the next hop.
Go deeper
What it looks like
R1# show ip route static | include 0.0.0.0
S* 0.0.0.0/0 is directly connected, GigabitEthernet0/0/0
R1# show ip arp GigabitEthernet0/0/0
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.0.2.80 3 00a0.c9aa.0101 ARPA GigabitEthernet0/0/0
Internet 198.51.100.25 0 00a0.c9aa.0101 ARPA GigabitEthernet0/0/0
Internet 203.0.113.1 41 00a0.c9aa.0101 ARPA GigabitEthernet0/0/0
Internet 203.0.113.2 - 0050.56b1.2c01 ARPA GigabitEthernet0/0/0
Internet 203.0.113.77 1 00a0.c9aa.0101 ARPA GigabitEthernet0/0/0R1 is 203.0.113.2/30 and the ISP is 203.0.113.1. Every remote internet address has an ARP entry, and all of them map to the ISP router's MAC. That is proxy ARP at work.
Why it hurts
- One ARP request and one adjacency per destination host. On an internet edge that is tens of thousands of entries, each kept for the IOS ARP timeout of 4 hours.
- CPU spent on ARP, and the first packet to each new destination waits for ARP.
- It depends on a feature many ISPs and firewalls disable. Without proxy ARP, every destination outside the /30 fails.
The fix
no ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 203.0.113.1Now there is one ARP entry, for 203.0.113.1, and one adjacency.
When interface-only is fine
On point-to-point interfaces (serial with HDLC or PPP, GRE tunnels, IPsec VTIs) there is no ARP and only
one possible neighbor, so ip route 10.50.0.0 255.255.255.0 Tunnel0 is normal.
They will ask next
Does disabling proxy ARP on your own router fix it?
No. Your router is the one sending the ARP requests. Proxy ARP has to be answered by the upstream router, so it is the upstream setting that matters.
Traps
- Saying the route works the same as one with a next hop. It works only while the neighbor does proxy ARP.