Understanding MFF
Implementation
Figure 7-1 demonstrates MFF implementation on an Ethernet network where the gateway performs unified network management and accounting. MFF is enabled on the Ethernet Access Node (EAN) so that user traffic passes through the gateway before being forwarded to other users at Layer 3. MFF isolates users at Layer 2 and helps enable traffic monitoring and accounting capabilities.
MFF uses the proxy ARP mechanism to reduce the number of broadcast packets between the network and users, thereby enabling isolation at Layer 2 while ensuring users are still able to communicate at Layer 3. The Proxy ARP mechanism will be described in this chapter.
Interface Roles
Two types of interfaces are available on an MFF-enabled device: user interfaces and network interfaces.
A user interface connects to user terminals and processes different packets as follows:
- Discards IGMP Query messages and permits other IGMP protocol packets and DHCP packets to pass through.
- Sends ARP packets to the CPU for processing.
- Processes the unicast packets of which the destination address is the gateway MAC address as follows:
- If the gateway MAC address has been learned, the user interface forwards these unicast packets and discards other packets.
- If the gateway MAC address has not been learned, the user interface discards all packets.
- Rejects multicast and broadcast data packets.
A network interface connects to such network devices as access switches, aggregation switches, or gateway and processes different packets as follows:
- Permits multicast and DHCP packets to pass through.
- Sends ARP packets to the CPU for processing.
MFF Functions
MFF provides the following functions: obtainment of gateway and user information, proxy ARP mechanism, gateway detection, application server access, User online status detection, isolated interface, and MFF security.
Obtainment of gateway and user information
Users can be allocated static IP addresses or dynamically obtain IP addresses using DHCP. Accordingly, a MFF-enabled device can obtain a manually configured gateway IP address or dynamically obtain a gateway IP address using the DHCP snooping function.
Manually configured gateway IP address
If IP addresses are manually assigned, the MFF-enabled device cannot obtain the gateway IP address through DHCP packets; therefore, the gateway IP address needs to be manually configured on the MFF-enabled device. After an IP address is configured for a static gateway, the MFF-enabled device captures the ARP request packets at the user side to trigger or update the MFF entries carrying user information. If the MFF-enabled device receives an ARP request packet without learning the gateway MAC address, the MFF-enabled device does not forward this ARP request packet. Instead, the MFF-enabled device sends an ARP request packet with the user's IP and MAC addresses as source information to the gateway, and learns the gateway MAC address from the ARP reply packet returned by the gateway.
Gateway IP address dynamically obtained with the DHCP snooping function
If the IP addresses are dynamically allocated through DHCP, the MFF-enabled device obtains the user's IP and MAC addresses from the DHCP snooping table and parses the option 121 or option 3 field in the DHCP ACK packets sent by the network interface to obtain the gateway IP address. The MFF-enabled device then sends an ARP request packet with the user's IP and MAC addresses as source information to the gateway, and learns the gateway MAC address from the ARP reply packet returned by the gateway.
The MFF-enabled device uses by default the first gateway MAC address to respond to ARP request packets from users after learning multiple gateway MAC addresses. As a result, ARP request packets are sent to the first gateway.
Proxy ARP
The MFF-enabled device captures the ARP request packets from users, and sends an ARP reply packet with the gateway MAC address as the source MAC address. This process ensures that all user devices map the gateway MAC address to the gateway IP address in their ARP tables so that all the packets from the user devices are destined for the gateway. The gateway can monitor traffic and perform accounting, and network security is enhanced.
When receiving an ARP request packet sent by a gateway to request a user MAC address, the MFF-enabled device responds with the MAC address.
Gateway detection
To detect gateway MAC address change in time, MFF supports timed gateway address detection. After the detection function is enabled, the MFF-enabled device scans recorded gateway information every 30 seconds. For each gateway recorded, the MFF-enabled device uses information about any user to construct an ARP request packet and sends it to the network interface. The MFF-enabled device then learns the gateway MAC address from the ARP reply packet. If the gateway MAC address has changed, the MFF-enabled device immediately updates the gateway information and broadcasts gratuitous ARP packets to user devices, so that user devices can update the gateway address.
If no user exists in a VLAN, the MFF-enabled device does not send any ARP request packet to the gateway until a user goes online.
Application server access
In addition to the gateway, a network may deploy application servers such as the DHCP, multicast, or another server, as illustrated in Figure 7-2. When users access an application server whose IP address is not specified on the MFF-enabled device, the MFF-enabled device forwards user traffic to the gateway. The gateway then forwards it to the application server. This increases uplink traffic, consumes bandwidth, and wastes forwarding resources on the gateway.
To address this problem, specify IP addresses of application servers on the MFF-enabled device and set up a list of them. When receiving an ARP request packet from a user, the MFF-enabled device sends an ARP reply packet with the application server MAC address as the source address. When receiving an ARP request packet from an application server, the MFF-enabled device sends an ARP reply packet with the requested user MAC address. In this way, users directly communicate with application servers at Layer 2.
User online status detection
If the gateway is used to perform accounting according to the length of time users are online, the gateway must be able to accurately record these durations. By default, a MFF-enabled device sends ARP reply packets in response to ARP request packets sent from the gateway. As a result, the gateway considers users online even if they have gone offline. To solve this problem, configure the MFF-enabled device to transparently transmit ARP request packets sent from the gateway to the user. Then, the MFF-enabled device does not respond to the ARP packets. If the gateway does not receive the ARP reply packet from a user, the gateway considers that the user has gone offline.
Isolated interface
In Figure 7-3, UserA and UserB connect to the network through an interface on SwitchB. When UserA sends an ARP request packet to request the MAC address of UserB, the ARP request packet is broadcast to both SwitchB and UserB. If SwitchB sends an ARP reply packet with the gateway MAC address to UserA, UserA receives two ARP reply packets. If the two ARP reply packets conflict, UserA may learn an incorrect ARP entry for UserB. The MFF-enabled device can perform interface consistency check for ARP request packets to solve this problem. If the interface that sends an ARP request packet is the same as the interface connected to the user with the requested address, the MFF-enabled device discards the ARP request packet.
In a data center that deploys server virtualization, multiple virtual machines (VMs) in a physical server may belong to the same VLAN and require Layer 2 isolation. The VMs connect to the same user interface on the MFF-enabled device and share an access link. Services on the VMs are often isolated, so the MFF-enabled device must function as an agent for the VMs and respond to ARP request packets to ensure Layer 3 communication among VMs.
To address this problem, the MFF-enabled device provides the isolated interface function. After an isolated interface is configured, the MFF-enabled device does not check interface consistency for ARP request packets sent from this interface and consequentially directly responds with ARP reply packets.
MFF security
A MFF-enabled device may learn information about some users through ARP snooping. If these users send forged ARP request packets to the MFF-enabled device, the MFF-enabled device learns information about a large number of nonexistent users. This wastes device resources and prevents the MFF-enabled device from learning information about authorized users and processing their legitimate services.
You can disable dynamic user learning for ARP snooping to prevent the MFF-enabled device from learning information about unauthorized users. Another solution is to set the maximum number of users in a VLAN low enough to prevent unauthorized access; this works because the number of DHCP users or static users on a network does not change greatly.
