[SOLVED] Switch keeps flushing Mac addresses causing floods.
We have 3 switches WS-C3560X-24 (version 15.0(2)SE2.) connected in a row, with dot1q Trunk between them, allowing vlan 10 only.
each switch has a 7200 router connected on port 1 - vlan 10 (internet access) running hsrp (only one is active).
and each switch has a FG firewall on port 10 - vlan 10 (three FW are clustered, only one active).
so far so good.
problem started when we inserted an IPS between them as a transparent device,
we took port 5 as IPS-external Access-vlan 10 and port 6 for IPS-internal Access-vlan 20, we also change the FW-wan to vlan 20.
traffic flow is as follows: FW-wan -> (p10) sw-vlan20 (p6) -> internal-IPS-External-> (p5) sw-vlan10 (p1) ->Router.
once we did that we noticed flooding on vlan 10, causing some packet loss toward the internet, which becomes more noticable when traffic increased.
the reason for the flooding is the router's standby (Virtual) and Bia Mac addresses which keep disapearing from the mac table of vlan 10 (and evantually also on vlan20). most important is the virtual mac that serve as DG not showing at all on vlan 20.
extra diags shows that all other mac addresses are steady in the mac table for the same vlan and this happens on all three switches, routers's macs are flushed and re-apearing after few seconds and so on.
the wierdest thing we also discovered is that it happens on all vlans that are trunked to the same router (on different sub-interfaces, of course),
temporary solutions that we found:
Once you shutdown port5 or 6 of the IPS on a specific switch, mac address table on that switch is steady -all is ok.
so instead of shutdown, (cause we want to use the IPS) we configured "no mac learning vlan 20" and it solved everything.
i know that basically we flooding traffic from FW to IPS-internal and vice versa, but it works.
Nevertheless, we don't understand what has happened in the switch that affected the mac learning proccess, switch logs shows nothing, Rstp does not show flaps or TCNs, no block port, no incosistent, loopgurad is on and reports nothing.
Sorry for the long previrew, it never happened to us with such topology.
Does anyone have a clue what is going on? is the a bug? a version issue? blame the IPS?
[RESOLVED] Switch keeps flushing Bia & Standby Mac addresses
version 15.0(2) SE2
If it helps anyone, I successfully simulated the problem on other switches in a lab.
After lots of testing, like QinQ and Private Vlan thats had same symptoms, i found that the issue is a version bug, in this version 15.0(2) SE2, which was tested on 5 different switches, the switch had hard time maintening it's "Per Vlan Address Table", mac's seems to leak thoughout the IPS machine (or direct cable), and the switch treats it as normal activity.
prior versions like 12.2(58) or next versions like 15.0(2) SE4, behaves normal, mac addresses are steady, no more flooding, at last.
This document gives several answers on frequently asked questions for PFRv3 channel state behavior.
Q1: What are all the channel operational states from a BR (border role) perspective and what are the rules/conditions to be in each st...
The need was to reach an host inside a LAN through a VPN connection managed by the LAN gateway (Cisco 1921).
The LAN gateway performs NAT and there was a dedicate nat rule for the host i wanted to reach through VPN.
I couldn't connect to the hos...
We have 3 identical switches configured by someone else and would like to claim some of the Gigabit ports(G1/G2/G3/G4) for use on servers. When we try to change the wiring and configuration, we run in to connectivity issues. Attached is a des...