Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Topology Change flooding

Hi,

When I connect my asa-5545X firewall to 2960 lanbase switch on gigabit port which is configured as an access port, that port starts generating topology changes. What can be the problem?

Thanks.

--

Erol

  • LAN Switching and Routing
5 REPLIES
VIP Purple

Re: Topology Change flooding

Configure: spanning-tree portfast default command on the swicth interface and then see the result.

Hope it helps.

Regards

Silver

Topology Change flooding

That´s the solution in whole networks for Topo-change but who can explain, why?

---

Posted by WebUser LA Ola from Cisco Support Community App

New Member

Topology Change flooding

This solves the TCN flood but still if I connect ASA to the switch our vlans start to act weird. For example two computers within the same vlan can't ping each other but another computer can ping both. Switch config is below;

interface GigabitEthernet0/3

switchport mode access

spanning-tree portfast

And my asa conifg is;

Result of the command: "show running"

: Saved

:

ASA Version 9.1(3)

!

hostname asa

domain-name xyz

enable password hGTP4tNDkziFC.TW encrypted

passwd hGTP4tNDkziFC.TW encrypted

names

!

interface GigabitEthernet0/0

nameif WAN

security-level 0

ip address xx.75.14.253 255.255.255.224

!

interface GigabitEthernet0/1

nameif LAN

security-level 0

ip address 10.0.0.240 255.255.248.0

!

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/4

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/5

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/6

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/7

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

management-only

nameif management

security-level 100

ip address 10.0.8.10 255.255.248.0

!

boot system disk0:/asa913-smp-k8.bin

boot system disk0:/asa912-smp-k8.bin

ftp mode passive

clock timezone EEST 2

clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00

dns domain-lookup LAN

dns server-group DefaultDNS

name-server 10.0.0.33

name-server 10.0.0.22

domain-name xyz

object network AP

subnet 10.0.48.0 255.255.248.0

description VLAN50

object network LAB

subnet 10.0.24.0 255.255.248.0

description VLAN20

object network SMART_BOARD

subnet 10.0.40.0 255.255.248.0

description VLAN40

object network BB_Switch

host 10.0.0.253

object network WAN_GW

host xx.75.14.225

access-list LAN_access_in extended permit ip any any

access-list LAN_access_in_1 extended permit ip any any

pager lines 24

logging asdm informational

mtu WAN 1500

mtu LAN 1500

mtu management 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-714.bin

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (LAN,any) source static any any

access-group LAN_access_in_1 in interface LAN control-plane

access-group LAN_access_in in interface LAN

route WAN 0.0.0.0 0.0.0.0 xx.75.14.225 1

route management 10.0.0.0 255.255.248.0 10.0.8.1 1

route LAN 10.0.24.0 255.255.248.0 10.0.0.253 1

route LAN 10.0.40.0 255.255.248.0 10.0.0.253 1

route LAN 10.0.48.0 255.255.248.0 10.0.0.253 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server AD protocol ldap

aaa-server AD (LAN) host 10.0.0.33

server-port 389

ldap-base-dn dc=x,dc=y,dc=z,dc=z

ldap-group-base-dn ou=Groups,ou=x,dc=x,dc=x,dc=x,dc=x

ldap-scope subtree

ldap-naming-attribute sAMAccountName

ldap-login-password *****

ldap-login-dn CN=ldap user,dc=x,dc=x,dc=x,dc=x

server-type microsoft

aaa-server AD (LAN) host 10.0.0.22

ldap-base-dn dc=x,dc=x,dc=x,dc=x

ldap-group-base-dn ou=Groups,ou=x,dc=x,dc=x,dc=x,dc=x

ldap-scope subtree

ldap-naming-attribute sAMAccountName

ldap-login-password *****

ldap-login-dn CN=ldap user,dc=x,dc=x,dc=x,dc=x

server-type microsoft

user-identity domain xyz aaa-server AD

http server enable

http 0.0.0.0 0.0.0.0 management

http 0.0.0.0 0.0.0.0 LAN

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 LAN

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

!

tls-proxy maximum-session 1000

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp server 10.0.0.33 source LAN prefer

ntp server 10.0.0.22 source LAN

username admin password KYSa/w/7GQlUqURl encrypted

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:7c8a85f40344725c9141690f9e73a659

: end

VIP Purple

Re: Topology Change flooding

I am not much aware about ASA Config but May be windows Firewall/ASA blockig the Ping Traffic on These Computer.

Regards
Sent from Cisco Technical Support iPhone App

Sent from Cisco Technical Support iPhone App

New Member

Re: Topology Change flooding

Unfortunately its not that simple, when we unplug asa everything goes normal..

214
Views
0
Helpful
5
Replies