Cisco default ARP timeout is 4 hours. Do anyone change that to
something shorter in a provider environment for customer with Ethernet
connectivity? What is a good value to set it to?
Are there any impacts for lowering the timeout? Other than higher CPU
util for doing ARP a lot more on the router?
I regularly used to lower the ARP timeout to 5 minutes (to match the
mac-address-table aging limit) on devices running on ATM LAN-E segments and
saw no ill effects.
-saxon
Maximum value should be your L2 MAC timeout. Most other vendors use low
limits these days (linux, junos come to mind).
So 300s max really.
If ARP timeout is higher than L2 MAC timeout you can cause loops in
otherwise correctly configured network.
I am using arp-timeout 900 (means 15min), because of having problems with
my upstream ethernet connection and everything is ok, and I have not seen
any relation between MAC Address aging time and that, aging time is default
300sec for me 
Thanks
Saku Ytti wrote the following on 8/10/2012 10:27 AM:
Cisco default ARP timeout is 4 hours. Do anyone change that to
something shorter in a provider environment for customer with Ethernet
connectivity? What is a good value to set it to?Maximum value should be your L2 MAC timeout. Most other vendors use low
limits these days (linux, junos come to mind).
So 300s max really.If ARP timeout is higher than L2 MAC timeout you can cause loops in
otherwise correctly configured network.
I haven't seen loops, but have seen unicast floods when the MAC address times out for a host that receives data, but does not transmit it (hence the switch often forgets the MAC for the device). On Cisco gear I found it simpler to increase the mac address timeout to match the ARP timeout because the MAC timeout is a global command and the ARP timeout was a per interface command. IIRC, Cisco recommends the two match under certain setups - VRRP/HSRP comes to mind. I would think that a matched setup would always be ideal, with shorter timeouts for networks that encounter more instability or user movement.
--Blake
IMO, it is a balancing-act(topology/traffic dependant) arp-broadcasts v/s unknown-unicast-floods.
In some cases I have lowered arp-timeout to match mac-ageing (8mins with dfc, and default 5 for non-dfc - cisco speak) In other cases, increasing mac-ageing to match arp-ageing - 4 hrs.
./Randy