DHCP, Gratuitous ARP, and Proxy ARP with XP

PeterUK
PeterUK Posts: 2,702  Guru Member
First Anniversary 10 Comments Friend Collector First Answer
edited April 2021 in Security

Yes XP is dead but I use it for testing and does a odd Decline for DHCP with this setup that WIN 7 & 10 or Ubuntu are fine with but found a reg key that fixed XP so I wanted to post this to show the problem I was having.

The setup is with a ZyWALL 110 and a port based VLAN like this:

https://businessforum.zyxel.com/discussion/comment/4580/#Comment_4580

With a VLAN 18 setup with set to Interface type general:

192.168.255.49/255.255.255.240

DHCP server

IP pool start address 192.168.255.50 pool size 3

Default router vlan18 IP

Enable Proxy ARP

192.168.255.48/28

Here what happens with win 10 that works fine

Here what happens with win XP

As you can see XP fails but with this registry key

https://www.itprotoday.com/compute-engines/how-can-i-disable-gratuitous-arp

it works!

So I was wondering if anything can be done on the USG/ZyWALL that would allow clients like XP to just work? 

Comments

  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,366  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    edited June 2019

    Hi @PeterUK

    Gratuitous ARP is requested from DHCP client for check if IP address is duplicated or not.

    Gratuitous ARP Relay is unable disable on ZyWALL.

  • PeterUK
    PeterUK Posts: 2,702  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer

    I bet you can in firmware override the Gratuitous ARP to not send it out.

    Its odd that WIN 7 & 10 or Ubuntu run fine with the setup but not XP.


  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,366  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer

    Hi @PeterUK

    I will send you private message for check your test environment more details.

  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,366  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer

    Hi @PeterUK

    I tried to setup your environment in my lab.

    But strange thing is GAPR did not reply to me after PC received IP address.

    Can you describe your switch configuration setting to me?

  • PeterUK
    PeterUK Posts: 2,702  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer

    Do you have a switch setup with port based VLAN and isolation between the ports?


    Are you testing with XP as win 7 & 10 are fine?


    Is proxy ARP enabled with 192.168.255.48/28 entered?


    Will post a draw up soon

  • PeterUK
    PeterUK Posts: 2,702  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer

    Ok here the setup

  • PeterUK
    PeterUK Posts: 2,702  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited June 2019
  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,366  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    edited June 2019

    Hi @PeterUK

    Thanks for shared your configuration of this scenario.

    The proxy ARP function will reply all ARP request which belonging to 192.168.255.48/28 subnet.(Including Gratuitous ARP)

    It may leads client unable get IP address after received Gratuitous ARP reply.


    At currently almost OS will ignore Gratuitous ARP reply packets (maybe OS will check If DHCP server and GARP MAC address are the same one)

    So Win7/Win10/Linux are able get IP address successfully.


    I will add it as idea for disable Gratuitous ARP reply in DHCP scenario.

  • PeterUK
    PeterUK Posts: 2,702  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer

    Ok good that disable Gratuitous ARP reply will be a option for such clients.

Security Highlight