[j-nsp] Junos ARP aging and refcnt

[Jon Lewis]

I've had some issues recently with ARP and am getting conflicting answers 
from JTAC, from google searching (and Google AI answers I can't 
substantiate) and emperical evidence.

We have the arp aging-timer set to 5[minutes]. Junos adds a random jitter 
to that value for each ARP entry to stagger ARP timeouts...so I see 
ARP table entries refresh and get TTE's of 5-6 minutes.

Where we've run into issues, and things get murky is exactly what the 
behavior should be when an ARP entry expires (and how refcnt might alter 
that behavior).  When doing FBF / policy routing utilizing next-ip, the 
behavior we've seen recently is that the next-ip's ARP entry expires and 
then the volume of traffic hitting the next-ip rule causes a resolve 
ucast-v4 ddos-protection protocol violation.  When the ddos-protection 
policer kicks in, sometimes the violation is brief and unnoticed. 
Sometimes it will persist indefinitely (until traffic stops hitting the 
FBF next-ip rule) causing policy routed traffic to blackhole.

I can't find detailed documentation on this from Juniper, but according to 
Google AI, Junos treats ARP entries with refcnt > 0 differently than 
refcnt = 0.  In practice, I've not been able to find an ARP entry with 
refcnt = 0.  It seems more like 1 is as low as refcnt can be, and an ARP 
entry that's next-hop for a route increments that entry's refcnt for each 
such active route.

What I've seen watching the ARP table is entries with refcnt > 1 can have 
their TTE reach 0, but they are not immediately removed.  Instead, they 
seem to be retained while an ARP is sent, and if a reply is received, the 
TTE is reset.

I can't find this behavior documented anywhere, but it's what I'm seeing.
So, I'm wondering if, when using next-ip in FBF, if it's best practice / 
required to have at least one route with that next-ip as next-hop (or just 
resort to a static ARP entry for the next-ip)?

----------------------------------------------------------------------
  Jon Lewis, MCP :)              |  I route
  Blue Stream Fiber, Sr. Neteng  |  therefore you are
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________