Skip to main content
Validating the ARP table is a critical troubleshooting step for ExpressRoute peering. ExpressRoute peering exchanges MAC information between your on-premises router and Microsoft’s edge, so correct ARP behavior is essential for packet delivery and overall connectivity. See ExpressRoute fundamentals for background on peering and routing. ARP (Address Resolution Protocol) maps IPv4 addresses (Layer 3) to MAC addresses (Layer 2). ARP operation is required so hosts on the same broadcast domain can deliver Ethernet frames to the correct destination. For IPv6, Neighbor Discovery Protocol (NDP) provides the equivalent functionality.
The image illustrates the Address Resolution Protocol (ARP) process, where a host requests the MAC address of an IP address through a router, and the router provides the corresponding MAC address.
ARP is a Layer 2 protocol defined in RFC 826. When troubleshooting ExpressRoute, confirm that both sides of the peering can resolve each other’s MAC addresses and that ARP table entries are present and current. Incorrect or missing ARP entries commonly indicate Layer 2 issues that will prevent traffic flow even when BGP appears up.
The image describes the Address Resolution Protocol (ARP) as a layer-2 protocol defined in RFC 826, which translates IP addresses to MAC addresses and is crucial for proper communication across network layers.

​
Key verification steps

  • Confirm ARP entries on your on-prem router/switch match the expected Microsoft peer IPs for the ExpressRoute session.
  • Ensure your device resolves the Microsoft-side MAC address for the ExpressRoute peer IP.
  • Look for stale, incomplete, or missing ARP entries — these point to Layer 2 problems.
  • Detect duplicate IP-to-MAC mappings (possible misconfiguration or MAC spoofing).
  • Verify VLAN tagging, subinterfaces, and physical cabling between your edge and the ExpressRoute port.
  • Check intermediate switches for security features (port-security, DHCP snooping, dynamic ARP inspection) that may block ARP.
  • Ensure BGP session stability — while ARP is Layer 2, BGP problems can obscure ARP symptoms and vice versa.

​
Quick checklist

​
Useful commands to inspect and clear ARP entries

Commands vary by platform — examples:
If you cannot see Microsoft’s internal ARP table, validate the MAC address that your on‑prem device learns for the ExpressRoute peer IP. That effective mapping—visible on your device—helps determine whether the problem originates upstream (Microsoft) or locally (your network).
The image outlines the purpose of ARP in ExpressRoute peering, highlighting the verification of IP-to-MAC mappings for each interface and ensuring that both ends of the peering can identify each other.
If ARP mappings remain missing or stale after clearing caches, escalate the investigation into the physical layer (cables, optics), VLAN trunk/access settings, and switch-level security that could filter ARP traffic. Also ensure the ExpressRoute circuit and its peerings are provisioned correctly and that BGP peering is stable.
The image lists common ARP errors, highlighting incomplete MAC address resolution for on-prem router IPs and missing Microsoft router entries in the ARP table.

​
References and further reading

Keep these checks as part of your ExpressRoute troubleshooting workflow to quickly isolate Layer 2 issues and restore correct IP-to-MAC mappings for reliable connectivity.

Watch Video