D-Link NetDefend DFL-1660, User Manual

Page: 130 / 595

connected to the firewall, it may be necessary to adjust this value upwards. This can be done by
modifying the ARP advanced setting ARP Cache Size.
Hash tables are used to rapidly look up entries in the ARP Cache. For maximum efficiency, a hash
table should be twice as large as the entries it is indexing, so if the largest directly connected LAN
contains 500 IP addresses, the size of the ARP entry hash table should be at least 1000. The
administrator can modify the ARP advanced setting ARP Hash Size to reflect specific network
requirements. The default value of this setting is 512.
The setting ARP Hash Size VLAN setting is similar to the ARP Hash Size setting, but affects the
hash size for VLAN interfaces only. The default value is 64.
3.5.3. ARP Publish
Overview
NetDefendOS supports the publishing of IP addresses on interfaces other than the one the IP address
is actually connected to. This can optionally be done along with a specific MAC address instead of
the publishing interface's MAC address. NetDefendOS will then send out ARP replies for ARP
requests received on the interface for the published IP addresses. This feature is referred to in
NetDefendOS as ARP Publish.
Usage
Publishing may be done for a number of reasons:
• To give the impression that an interface in NetDefendOS has more than one IP address.
This is useful if there are several separate IP spans on a single LAN. The hosts on each IP span
may then use a gateway in their own span when these gateway addresses are published on the
corresponding NetDefendOS interface.
• Another use is publishing multiple addresses on an external interface, enabling NetDefendOS to
statically address translate traffic to these addresses and send it onwards to internal servers with
private IPv4 addresses.
• A less common purpose is to aid nearby network equipment responding to ARP in an incorrect
manner.
Methods of Enabling ARP Publishing
ARP publishing is enabled in one of two ways:
• An ARP object can be created for any interface by defining a single address which is to be ARP
published on that interface.
• When a static route is created for an IPv4 address or network, the route option called Proxy ARP
can be used to publish the address or network on all or selected interfaces.
Using ARP objects, single IP addresses only can be published one at a time. However, the Proxy
ARP feature can publish entire networks. It also provides a single step to publish on all
interfaces.
Proxy ARP is covered in Section 4.2.6, “Proxy ARP” and is not discussed further in this
section.
ARP Object Properties
3.5.3. ARP Publish Chapter 3. Fundamentals
130