Two bridges and arp reply blocking

[BioZ]

Hi,

I'm trying to establish two EtherIP tunnels terminating at one VM.
The problem is, when I'm trying to ping between those two remote networks, there is a complete travel of ARP request, but ARP reply encapsulated in etherip can be dumped at relevant public interface, while neither on bridge nor another interface (bridge1 and em2 below). Thus ARP reply doesn't reach requester and ping cannot be successful.

Idea and network configuration:
The VM looks like this when looking at interfaces:

[Internet] em0--bridge0--gif0->em3 [LAN with a switch]
[Internet] em1--bridge1--gif1->em2 [LAN with a switch]

After the VM there is a router:
- one public interface
- one interface with /29 IP address, connected to the vmnic on VMware, to which em0 and em1 are related
- one interface connected to the vmnic on VMware, to which em2 and em3 are related

It should be working in a way, that etherip frames coming from two remote networks reach em0 or em1 via the router, afterwards get decapsulated and regular traffic comes back to the router via em3 or em2. Then it is being routed either somewhere else in my LAN or to one of the remote LANs.

My /etc/rc.conf (A is my addressing space, B and C are the remote networks):

hostname=""
sshd_enable="YES"
dumpdev="NO"
defaultrouter="A.1"

cloned_interfaces="gif0 bridge0 gif1 bridge1"

ifconfig_em0="A.2/29 broadcast A.7 up"
ifconfig_em3="up"
ifconfig_gif0="tunnel A.2 B mtu 1500 up"
ifconfig_bridge0="mtu 1500 addm gif0 addm em3 up"

ifconfig_em1="A.3/29 broadcast A.7 up"
ifconfig_em2="up"
ifconfig_gif1="tunnel A.3 C mtu 1500 up"
ifconfig_bridge1="mtu 1500 addm gif1 addm em2 up"

Things tested already:
I've found here: forums.freebsd.org/showthread.php?t=19708&highlight=bridge
To try with disabling three sysctls, it didn't do the work.
I've also manually turned down and up again all em interfaces.

Other potentially useful information:
I'm using FreeBSD 9.0 release.
IPFW, PF, IPsec etc. is taken off for debugging.
Network configuration, VM configuration and /etc/rc.conf have been crosschecked.

Ifconfig -a:

em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
        ether (mac)
        inet6 (...) prefixlen 64 scopeid 0x1
        inet (A.2) netmask 0xfffffff8 broadcast (A.7)
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
        ether (mac)
        inet6 (...) prefixlen 64 scopeid 0x2
        inet (A.3) netmask 0xfffffff8 broadcast (A.7)
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
em2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=98<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
        ether (mac)
        inet6 (...) prefixlen 64 scopeid 0x3
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
em3: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=98<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
        ether (mac)
        inet6 (...) prefixlen 64 scopeid 0x4
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=3<RXCSUM,TXCSUM>
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
        inet 127.0.0.1 netmask 0xff000000
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
        tunnel inet (A.2) --> (B)
        inet6 (...) prefixlen 64 scopeid 0x7
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        options=1<ACCEPT_REV_ETHIP_VER>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether (mac)
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: em3 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 4 priority 128 path cost 20000
        member: gif0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 7 priority 128 path cost 55
gif1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
        tunnel inet (A.3) --> (C)
        inet6 (...) prefixlen 64 scopeid 0x9
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        options=1<ACCEPT_REV_ETHIP_VER>
bridge1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether (mac)
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: em2 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 3 priority 128 path cost 20000
        member: gif1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 9 priority 128 path cost 55

Please guide me with troubleshooting the issue, it confuses me a lot.

Regards.

 

[BioZ]

Uh, sorry, the VM should be shown like that according to the configuration:

[Internet] em0<->gif0--bridge0--em3 [LAN with a switch]
[Internet] em1<->gif1--bridge1--em2 [LAN with a switch]

Regards.

 

[BioZ]

Hi,

Sorry for not being precise enough - ping another way shows also frames are being blocked and not tcpdumped.

In general, is FreeBSD capable of serving as an endpoint for more than one tunnel? Maybe that's the issue, or something with the bridge/gif itself... Sorry, I find my lack of skills disturbing.

Regards.