(sorry for incorrect grammar, I'm not native speaking)
Just for curiosity ZeroByte ..which are the drawbacks if we put static and pppoe customers on the same lanX? I mean, in such scenario with few public addresses.
My question arises because I always try to avoid proxy-arp whenever possible. Probably my problem with proxy-arp is that I see it as a "kind of a uncontrollable short circuit" .. I'm always concerned when I try to figure out how to deal with it in quite complex firewall scenario and if my rules will be honored (please don't laugh too much
).
Furthermore I know best practice is not to put ip address onto pppoe server interface but I miss the real reasons.
Thanks
Keep in mind the fact that PPPoE is a layer2 protocol.
Therefore, putting PPPoE onto the same physical interface as the native IP clients use is
not putting the PPPoE user(s) on the same IP interface anyway.
At layer 3, the PPPoE user is connected to a logical IP interface with its own associated /32 route.
It's not a "drawback" to do this - per-se, but it's a tad sloppy IMO.
As for proxy-arp, it's generally not going to hurt anything - it's active by default on every arp-using interface in Cisco, so obviously it can't be too dangerous to leave it laying around.
I've only been bitten by proxy arp a couple of times in my entire career, and invariably it involves having multiple IP subnets on the same broadcast domain.
As long as you follow good practices, proxy arp is very unlikely to jump out of the bushes and ruin your day.
I know you've read several of my posts about proxy arp before, but if I were to sum it all up here - all proxy-arp does is reply to ARP requests for IP addresses which are known to the router, and exist on or beyond any interface OTHER than the one receiving the ARP request.
To me, it's neither good nor bad practice to activate/deactivate proxy-arp everywhere. I think if I were making a network that I wanted to be as tight as possible, I would turn it off on access-layer interfaces just because it allows for sloppiness / gives a potential way to get things through that you may not have considered, but there's not much difference between an endpoint taking advantage of proxy arp, and an endpoint that just statically defines your router's MAC address as the ARP entry for whatever IP it wants.