When proxy-arp is enabled on a VLAN interface, it also seems to apply to the underlying Ethernet interface. For example:
ROUTER A
ether1 --> 10.20.3.1/24 (arp = enabled)
vlan 200 -> 192.168.0.1/24 (arp = proxy-arp)
ether2 --> 10.50.5.2/24 (arp = enabled)
ROUTER B
ether1 --> 10.20.3.2/24 (arp = enabled)
ether2 --> 10.40.4.1/24 (arp = enabled)
Router A and B are connected via their respective ether1 interfaces; as would be suggested by the IP subnets. Proxy-arp is enabled on VLAN 200 on Router A to enable PPTP access to the 192.168.0.X subnet. Router A and B are OSPF neighbors.
Now the problem lies in the fact that Router A will start replying to ARP requests for hosts in the 10.20.3.X subnet when Router B sends out ARP requests. This problem causes real hosts connected to the 10.20.3.X subnet to get masked off because the ARP table on Router B will get "poisened" by the proxy-arp replies from Router A. Note that Router A does NOT have proxy-arp enabled on the native Ether1 interface, only on the VLAN200 interface on Ether1. Since VLAN's should be virtually seperate Ethernet interfaces, this should not be occuring.
[/img]