Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

6509E with Sup720 - Show mac address

I have seen very strange behavior. The following two commands show different outputs...

core2#sho mac address-table dynamic | in cc04

     7  0009.0fbb.cc04   dynamic  Yes        150   Po10

core2#sho mac address-table address 0009.0fbb.cc04

Legend: * - primary entry

        age - seconds since last seen

        n/a - not available

  vlan   mac address     type    learn     age              ports

------+----------------+--------+-----+----------+--------------------------

No entries present.

Po10 is etherchannel to core1. The MAC address is on the core2 and should never be learned on core1. Core1 doesn't learn this MAC address at all.

The commands are run at the same time. I repeated many times and it is the same... Any idea why?

Thanks!

Difan

16 REPLIES
Hall of Fame Super Blue

6509E with Sup720 - Show mac address

Difan

Can you try -

sh mac-address-table dynamic address 0009.0fbb.cc04

Jon

New Member

6509E with Sup720 - Show mac address

core2#sh mac-address-table dynamic address 0009.0fbb.cc04

Legend: * - primary entry

        age - seconds since last seen

        n/a - not available

  vlan   mac address     type    learn     age              ports

------+----------------+--------+-----+----------+--------------------------

No entries present.

Well we think that the device with the MAC rarely sends out traffic so the MAC times out all the time. However it should never point to core1... We enabled spanning-tree status logging on all the links with that vlan and we don't see any events happening...

Thanks Jon!

Hall of Fame Super Blue

6509E with Sup720 - Show mac address

When it does point to core1 what does the mac address table on that switch show ?

What is the device and how is it connected ie. is it directly connected to core2 or is it on an access switch ?

If it is an access switch is that switch connected to both core switches ?

Jon

New Member

6509E with Sup720 - Show mac address

Yes there are access switches connected to both core1 and core2. However the STP and links are all stable. No logs are seen at all for any flapping or anything

When it happens, on core1 it doesn't have the MAC, with either command...

Thanks,

Hall of Fame Super Blue

6509E with Sup720 - Show mac address

So the vlan the device is in, lets say vlan 10.

Your two core switches are not running VSS ?

If they are not running VSS then it sounds like you have a standard L2/3 design ie.

1) the two core switches are interconnected by a L2 etherchannel trunk

2) the access switch is connected to both cores with L2 links, either trunk links or access links depending on whether the access switch has multiple vlans on it.

3) one of those uplinks must be blocking for vlan 10

So if you do a "sh spanning-tree vlan 10" on the access switch which link is being blocked ie. the one to core1 or the one to core2 ?

Jon

New Member

Re: 6509E with Sup720 - Show mac address

Hi Jon,

Correct, I am not using VSS. However it is not standard set up. The vlan 7 is extended to many other switches. The root is actually not core1 or core2. It also passes some provider to different location as well. However like you said, all the correct ports are blocked. Please trust me on this.. If there is a loop, we will have much more serious problem... At least our CPU will hike and link will congested, right?

I know your concern that the same packet could be somehow loopped back through core1, which makes core2 to learn the MAC on the port-channel interface to core1. However when this happens, core1 doesn't learn the MAC anywhere and on core2 some command show the MAC but not the other command...

Also something interesting, even that MAC in the command will eventually disappear. Please note the aging time. The aging time configured on the vlan is 480 seconds. At last the MAC address is pointing to another interface like G1/1. That interface doesn't even have vlan 7 allowed on the trunk link.

core2#sho mac address-table address 0009.0fbb.cc04

Legend: * - primary entry

        age - seconds since last seen

        n/a - not available

  vlan   mac address     type    learn     age              ports

------+----------------+--------+-----+----------+--------------------------

No entries present.

core2#

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        285   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        290   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        300   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        305   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        315   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        320   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        320   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        330   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        335   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        340   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        375   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        405   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        425   Po10

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        465   Gi1/1

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        480   Gi1/1

core2#show mac address-table | in 0009.0fbb.cc04

     7  0009.0fbb.cc04   dynamic  Yes        480   Gi1/1

core2#show mac address-table | in 0009.0fbb.cc04

core2#show mac address-table | in 0009.0fbb.cc04

core2#sho mac address-table address 0009.0fbb.cc04

Legend: * - primary entry

        age - seconds since last seen

        n/a - not available

  vlan   mac address     type    learn     age              ports

------+----------------+--------+-----+----------+--------------------------

No entries present.

core2#sh int g1/1 trunk

Port                Mode         Encapsulation  Status        Native vlan

Gi1/1               on           802.1q         trunking      1

Port                Vlans allowed on trunk

Gi1/1               64,72,156,214-216,300,600

Port                Vlans allowed and active in management domain

Gi1/1               64,72,156,214-216,300,600

Port                Vlans in spanning tree forwarding state and not pruned

Gi1/1               64,72,156,214-216,300,600

Is it a bug?

Thanks!

Hall of Fame Super Blue

Re: 6509E with Sup720 - Show mac address

I don't think you have a L2 loop because as you say you would probably have far more serious issues than this.

It's hard to say whether it is a bug without understanding -

1) the full topology including root switches etc.

2) what the device actually is and how is it connected ie. is it just one NIC, does it have multiple NICs, is the NIC trunking or not etc.

Is it strange if the access port the device is connected to is configured as an access port in vlan 7 that it is being seen via g1/1 which is not allowing vlan 7 on the trunk.

Difficult to say with the information provided so far.

Jon

New Member

Re: 6509E with Sup720 - Show mac address

Even we don't have a diagram lol We just took over support.

Regarding to that Gi1/1 thing, no matter how the MAC is learned, from a trunk port or access port, it is just a MAC on vlan 7 correct? However why on earth the switch thinks that the MAC is learned from this Gi1/1 which doesn't even permit vlan 7 on it? The device on the other end is a Cisco 3750 switch that is connected on this Gi1/1 and it doesn't even vlan 7 exist...

Hall of Fame Super Blue

6509E with Sup720 - Show mac address

Regarding to that Gi1/1 thing, no matter how the MAC is learned, from a trunk port or access port, it is just a MAC on vlan 7 correct?

Correct but i was more concerned with the end device to be honest and how it was connected. For example if it had a sinle NIC and the switchport it was connected to was configured as an access port in vlan 7 then what you are seeing is strange.

Jon

New Member

6509E with Sup720 - Show mac address

I see. The device with the MAC is a big firewall chassis. It has many interfaces, like over 10. It is connected on a 20G etherchannel

interface Port-channel20

description F5140 Sw2 (Members F5,F6)

switchport

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 7

switchport mode trunk

switchport nonegotiate

logging event link-status

end

Group  Port-channel  Protocol    Ports

------+-------------+-----------+-----------------------------------------------

20     Po20(SU)        LACP      Te4/7(P)       Te4/8(P)

Hall of Fame Super Blue

6509E with Sup720 - Show mac address

Okay but only vlan 7 is allowed on that trunk link so if that is the only connection from the firewall to your switch infrastructure then all mac addresses associated with the firewall should be seen in vlan 7 only.

I'm not sure why it is a trunk if it is only allowing vlan 7 ie. why is it not just a port channel interface in vlan 7.

What does a "sh int trunk" show from the switch that the port channel is connected ?

Jon

New Member

6509E with Sup720 - Show mac address

Actually in my previous show commands, the MAC is learned in vlan 7 only. The MAC was never learned in other vlans

core2#show mac address-table | in 0009.0fbb.cc04

     0009.0fbb.cc04   dynamic  Yes        480   Gi1/1

Here is the show command you requested

core2#sh int po20 trunk

Port                Mode         Encapsulation  Status        Native vlan

Po20                on           802.1q         trunking      1

Port                Vlans allowed on trunk

Po20                7

Port                Vlans allowed and active in management domain

Po20                7

Port                Vlans in spanning tree forwarding state and not pruned

Po20                7

Thanks!

Hall of Fame Super Blue

6509E with Sup720 - Show mac address

That is strange.

Clearly your outputs show gi1/1 not allowing vlan 7 but your mac address outputs show it being learnt on that port.

What does a "sh int trunk" show from the access switch on the port connecting to g1/1 on core 2 ?

Jon

New Member

6509E with Sup720 - Show mac address

I actually already provided it in my previous post but here it is again..

core2#sh int g1/1 trunk

Port                Mode         Encapsulation  Status        Native vlan

Gi1/1               on           802.1q         trunking      1

Port                Vlans allowed on trunk

Gi1/1               64,72,156,214-216,300,600

Port                Vlans allowed and active in management domain

Gi1/1               64,72,156,214-216,300,600

Port                Vlans in spanning tree forwarding state and not pruned

Gi1/1               64,72,156,214-216,300,600

I will have to work on something else... Might not respond to your questions right away. Thank you very much for your help no matter how this turns out.

Hall of Fame Super Blue

6509E with Sup720 - Show mac address

I actually already provided it in my previous post but here it is again..

I meant from the access switch end not core2 end.

It isn't working as i expect so it may be a bug.

What IOS are you running ?

Jon

New Member

Re: 6509E with Sup720 - Show mac address

Here is from the access switch sw03

sw03#sh cdp nei gi2/0/28

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,

                  D - Remote, C - CVTA, M - Two-port Mac Relay

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID

core2

                 Gig 2/0/28        155             R S I  WS-C6509- Gig 1/1

!

sw03#sh vlan id 7

VLAN id 7 not found in current VLAN database

!

sw03#sh int g2/0/28 trunk

Port        Mode             Encapsulation  Status        Native vlan

Gi2/0/28    on               802.1q         trunking      1

Port        Vlans allowed on trunk

Gi2/0/28    1-4094

Port        Vlans allowed and active in management domain

Gi2/0/28    1,64,72,156,214-216,300,600

Port        Vlans in spanning tree forwarding state and not pruned

Gi2/0/28    1,300

!

Thanks,

562
Views
0
Helpful
16
Replies