cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post

Support for ARP collection from VRF/MPLS routing instances

Support for ARP collection from VRF/MPLS routing instances

We make extensive use of VRFs to segregate subnetworks according to the network policies in effect. Subnetworks within a VRF can communicate (fairly) unfettered, but to cross between VRFs traffic has to (normally) pass through a policy device. VRF-Lite merges all of the information into a common set of tables, but in a full VRF network things like the ARP and Routing tables are completely segregated by the routing instance. This allows traffic to get high-speed routing between networks with a common security profile, and consistently apply the right set of policy devices.

Here is an sample of some of the VRFs we operate ( from a Juniper router)

SNMPv2-SMI::enterprises.2636.3.26.1.2.1.5.2.2.97.99 = STRING: "ac"

SNMPv2-SMI::enterprises.2636.3.26.1.2.1.5.2.2.102.110 = STRING: "fn"

SNMPv2-SMI::enterprises.2636.3.26.1.2.1.5.2.2.114.104 = STRING: "rh"

SNMPv2-SMI::enterprises.2636.3.26.1.2.1.5.2.2.117.119 = STRING: "uw"

SNMPv2-SMI::enterprises.2636.3.26.1.2.1.5.2.4.109.103.109.116 = STRING: "mgmt"

SNMPv2-SMI::enterprises.2636.3.26.1.2.1.5.2.4.116.101.115.116 = STRING: "test"

SNMPv2-SMI::enterprises.2636.3.26.1.2.1.5.2.4.117.119.116.118 = STRING: "uwtv"

SNMPv2-SMI::enterprises.2636.3.26.1.2.1.5.2.4.118.111.105.112 = STRING: "voip"

SNMPv2-SMI::enterprises.2636.3.26.1.2.1.5.2.4.119.105.102.105 = STRING: "wifi"

So, when a router is in MPLS mode some of the tables are global, others may be scoped by router instance, as described in this document:

http://www.juniper.net/techpubs/en_US/junos12.1/topics/concept/understanding-snmp-support-for-routin...

To access the ARP tables for the ac routing instance then the snmp community is 'ac@community'

I'd like UDT to be enhanced to maintain a list of VRFs to scan for ARP data, and prepend vrf@ to the community when retrieving data separated by instance.

Thanks

/RjL

5 Comments
Level 16

You know it's a "Cisco shop" 🙂

Level 10

We won't be paying any more maintenance on UDT from this year onward. We're working an open source replacement that allows us to import data from our NAC and that will read VRF ARP data from our Arista distribution routers. We've replaced nearly every piece of Cisco gear in our core and distribution with Arista equipment.

Level 16

I am truly disappointed that this has not been implemented after more than four years; I've asked customerservice about the status of this feature, as workaround have impacts on other parts of the platform and there has been more than long enough time to get this implemented.

What solution are you looking at?

Level 10

The tool we're using now is called netdb. It's perl-based.

I sympathize with your situation; we're also looking at getting out of UDT due to challenges it's placed on our nodes resources and inaccurate data being reported. 

On the other hand, when it works well it's sure nice and easy to use it to search for and find the switchport a node is attached to.  That's a frequent task we have to perform as we micromanage NAC and troubleshoot devices that don't comply will network standards.  Having to open yet another app just to do what UDT should be able to do is not a good solution.