cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
793
Views
0
Helpful
3
Replies

IP Phone brought down 3560 Switch

patrick.roche
Level 1
Level 1

Hello,

I recently had a situation whereby someone plugged 2 patch cables from the same stack into the 2 ports of a 7911 phone, thus bringing down the stack.


Ports affected were Fa0/11 anf Fa0/13. Both went error dsiabled (as expected), but when one of the ports was re-enabled it brought the stack down. Portfast and BPDU guard were both enabled (see config below).

We're about to start a Rollout of 3500 IP phones and I can see this happening again (due to user error). My query is, is there any other config changes/commands we can use to prevent such a catastrophic event happening again due to a cabling error.


Fa0/11

!
interface FastEthernet0/11
switchport access vlan 20
switchport mode access
switchport voice vlan 60
switchport port-security maximum 3
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
switchport port-security aging static
srr-queue bandwidth share 15 20 20 45
priority-queue out
mls qos trust dscp
spanning-tree portfast
spanning-tree bpduguard enable
service-policy input User-Edge-Policy

interface FastEthernet0/13
switchport access vlan 20
switchport mode access
switchport voice vlan 60
switchport port-security maximum 3
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
switchport port-security aging static
srr-queue bandwidth share 15 20 20 45
priority-queue out
mls qos trust dscp
spanning-tree portfast
spanning-tree bpduguard enable
service-policy input User-Edge-Policy
!

1 Accepted Solution

Accepted Solutions

jkillion
Level 1
Level 1

Hey Patrick -

With portfast enabled, a port goes directly to forwarding mode and bypasses the initial STP steps.  When go directly to fowarding *and* create a physical loop, you create an processor issue.  This is due to L2 frames having no TTL field, thus continuing to loop infinitum.  To stop the packets from looping, one of the following must happen...

1.  Utilize STP to block one of the redundant ports.

2.  Unplug one of the cables.

3.  Wait for the sun to nova.

I would go with options one or two....

From a proactive approach, you do have BPDU guard enabled which is a great start.  The mistake you made was not heeding the BPDU condition.  If a port goes err-disabled, you should check to ensure a physical loop has not been created prior to re-enabling the port.

Your other option is to turn portfast off on the port, thereby allowing STP to do take care of blocking any secondary cable plugged in by accident.

HTH

View solution in original post

3 Replies 3

jkillion
Level 1
Level 1

Hey Patrick -

With portfast enabled, a port goes directly to forwarding mode and bypasses the initial STP steps.  When go directly to fowarding *and* create a physical loop, you create an processor issue.  This is due to L2 frames having no TTL field, thus continuing to loop infinitum.  To stop the packets from looping, one of the following must happen...

1.  Utilize STP to block one of the redundant ports.

2.  Unplug one of the cables.

3.  Wait for the sun to nova.

I would go with options one or two....

From a proactive approach, you do have BPDU guard enabled which is a great start.  The mistake you made was not heeding the BPDU condition.  If a port goes err-disabled, you should check to ensure a physical loop has not been created prior to re-enabling the port.

Your other option is to turn portfast off on the port, thereby allowing STP to do take care of blocking any secondary cable plugged in by accident.

HTH

Hello HTH,

Thanks for the advice, very helpful.

Pat

Leo Laohoo
Hall of Fame
Hall of Fame

I can see you have "spanning-tree portfast" and "spanning-tree bpduguard enable" but do you have the global command to re-enable a disabled port?  If you have, then take this off.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card