Network crash with Aruba 2530-8G switches

[DSI-SRT]

Hello,

We are having issues with Aruba 2530-8G switches on our network.

Our network is made up of HP 5130-48G-PoE + -4SFP + (370W) EI&HP 5130-24G-PoE + -4SFP + (370W) EI switch.

The 1st (on remote site) becomes inaccessible during network loops, forcing an electrical restart.

Here is its configuration:

; J9774A Configuration Editor; Created on release #YA.16.04.0016
; Ver #10:19.02.13.98.82.34.61.18.28.f3.84.9c.63.ff.37.27:00
console idle-timeout 300
console idle-timeout serial-usb 300
fault-finder broadcast-storm sensitivity high
fault-finder over-bandwidth sensitivity high
fault-finder loss-of-link sensitivity high
trunk 9-10 trk1 trunk
banner motd <...>
timesync ntp
ntp unicast
ntp server <...> iburst
ntp enable
no telnet-server
time daylight-time-rule western-europe
time timezone 60
ip default-gateway <...>
ip ssh filetransfer
ip route <...> <...>
interface 1
   name "## TEL et PC ##"
   power-over-ethernet high
   poe-lldp-detect enabled
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
interface 2
   name "## LOGES ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
interface 3
   name "## Voix ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
interface 4
   name "## PAILS ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
interface 5
   name "## DSI TEL et PC ##"
   power-over-ethernet high
   poe-lldp-detect enabled
   qos trust dot1p
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
interface 6
   name "## DSI TEL et PC ##"
   poe-lldp-detect enabled
   qos trust dot1p
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
interface 7
   name "## AXEL ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
interface 8
   name "## PC  ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
interface 9
   name "SWITCH en preparation"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
interface 10
   name "Vers-SW_DSI"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   exit
snmp-server community <...> operator
snmp-server community <...> unrestricted
snmp-server host <...> community <...> trap-level all
snmp-server host <...> community <...> trap-level all
snmp-server enable traps mac-notify
snmp-server contact <...> location <...>
vlan 1
   name "DATA"
   no untagged 2-6
   untagged 1,Trk1
   tagged 7-8
   no ip address
   exit
vlan 3
   name "LOGES"
   untagged 2
   tagged Trk1
   no ip address
   exit
vlan 18
   name "Voix"
   untagged 3
   tagged 1,5-6,Trk1
   no ip address
   exit
vlan 19
   name "Pails"
   untagged 4
   tagged Trk1
   no ip address
   exit
vlan 27
   name "Axel"
   untagged 7
   tagged Trk1
   no ip address
   exit
vlan 120
   name "DSI_DATA"
   untagged 5-6
   tagged Trk1
   no ip address
   exit
vlan 155
   name "ADMIN_SW"
   tagged Trk1
   ip address <...> <...>
   forbid 8
   exit
spanning-tree
spanning-tree 1 admin-edge-port
spanning-tree 1 loop-guard bpdu-protection
spanning-tree 2 admin-edge-port
spanning-tree 2 loop-guard bpdu-protection
spanning-tree 3 admin-edge-port
spanning-tree 3 loop-guard bpdu-protection
spanning-tree 4 admin-edge-port
spanning-tree 4 loop-guard bpdu-protection
spanning-tree 5 admin-edge-port
spanning-tree 5 loop-guard bpdu-protection
spanning-tree 6 admin-edge-port
spanning-tree 6 loop-guard bpdu-protection
spanning-tree 7 admin-edge-port
spanning-tree 7 loop-guard bpdu-protection
spanning-tree 8 admin-edge-port
spanning-tree 8 loop-guard bpdu-protection
spanning-tree Trk1 priority 4
spanning-tree mode rapid-pvst
spanning-tree trap errant-bpdu loop-guard
spanning-tree bpdu-protection-timeout 300 force-version rstp-operation
no tftp client
no tftp server
loop-protect 1-8
loop-protect 1-8 receiver-action send-recv-dis
loop-protect trap loop-detected
loop-protect mode vlan
loop-protect disable-timer 30
no dhcp config-file-update
no dhcp image-file-update
password operator

interface 1
   name "## TEL et PC ##"
   power-over-ethernet high
   poe-lldp-detect enabled
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   tagged vlan 18
   untagged vlan 1
   spanning-tree admin-edge-port
   spanning-tree loop-guard bpdu-protection
   loop-protect
   exit
interface 2
   name "## LOGES ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   untagged vlan 3
   spanning-tree admin-edge-port
   spanning-tree loop-guard bpdu-protection
   loop-protect
   exit
interface 3
   name "## Voix ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   untagged vlan 18
   spanning-tree admin-edge-port
   spanning-tree loop-guard bpdu-protection
   loop-protect
   exit
interface 4
   name "## PAILS ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   untagged vlan 19
   spanning-tree admin-edge-port
   spanning-tree loop-guard bpdu-protection
   loop-protect
   exit
interface 5
   name "## DSI TEL et PC ##"
   qos trust dot1p
   power-over-ethernet high
   poe-lldp-detect enabled
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   tagged vlan 18
   untagged vlan 120
   spanning-tree admin-edge-port
   spanning-tree loop-guard bpdu-protection
   loop-protect
   exit
interface 6
   name "## DSI TEL et PC ##"
   qos trust dot1p
   poe-lldp-detect enabled
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   tagged vlan 18
   untagged vlan 120
   spanning-tree admin-edge-port
   spanning-tree loop-guard bpdu-protection
   loop-protect
   exit
interface 7
   name "## AXEL ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   tagged vlan 1
   untagged vlan 27
   spanning-tree admin-edge-port
   spanning-tree loop-guard bpdu-protection
   loop-protect
   exit
interface 8
   name "## PC  ##"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   tagged vlan 1
   spanning-tree admin-edge-port
   spanning-tree loop-guard bpdu-protection
   loop-protect
   exit
interface 9
   name "SWITCH en preparation"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   untagged vlan 1
   trunk trk1 trunk
   exit
interface 10
   name "Vers-SW_DSI"
   rate-limit bcast in percent 10
   rate-limit mcast in percent 10
   untagged vlan 1
   trunk trk1 trunk
   exit
interface Trk1
   tagged vlan 3,18-19,27,120,155
   untagged vlan 1
   spanning-tree priority 4
   exit

The 2nd (on our site) seems to have generated a network loop for us and yet there is none.

Here is its configuration:

; J9774A Configuration Editor; Created on release #YA.16.04.0016
; Ver #10:19.02.13.98.82.34.61.18.28.f3.84.9c.63.ff.37.27:00
hostname "Neptune"
fault-finder broadcast-storm sensitivity high action warn-and-disable
trunk 2 trk2 lacp
trunk 3 trk3 lacp
trunk 4 trk4 lacp
trunk 8 trk8 lacp
trunk 9 trk9 lacp
banner motd <...>
timesync ntp
ntp unicast
ntp server <...> iburst
ntp enable
no telnet-server
time daylight-time-rule western-europe
time timezone 60
ip default-gateway <...>
ip route <...> <...>
interface 1
   name "Epson I0517 <...>"
   exit
interface 2
   name "PC DIRECTEUR U1084 "
   exit
interface 3
   name "PRISE PC 2 DIR BUREAU PROCHE ESCALIER"
   exit
interface 4
   name "TEL ET PC"
   exit
interface 5
   name 'ECRAN TACTILE MSI PRISE "BORNE" '
   exit
interface 6
   name "BADGEUSE BGTT037 NEPTUNE "
   exit
interface 7
   name "BADGEUSE BGTT018 LACORE"
   exit
interface 8
   name "TEL ET PC"
   exit
interface 9
   name "TEL ET PC"
   exit
interface 10
   name "LIEN VERS LACORE"
   exit
snmp-server community <...>
snmp-server community <...> unrestricted
snmp-server host <...> community <...> trap-level critical
snmp-server enable traps mac-notify
snmp-server contact <...> location <...>
vlan 1
   name "DATA"
   untagged 1,5-7,10,Trk2-Trk4,Trk8-Trk9
   no ip address
   exit
vlan 18
   name "Telephonie"
   tagged 1,10,Trk2-Trk4,Trk8-Trk9
   no ip address
   exit
vlan 112
   name "ENFANCE_DATA"
   tagged 10
   no ip address
   exit
vlan 130
   name "Equipements"
   tagged 10
   no ip address
   exit
vlan 155
   name "ADMIN_SW"
   tagged 10
   ip address <...> <...>
   exit
vlan 212
   name "ENFANCE_Print"
   tagged 10
   no ip address
   exit
spanning-tree
spanning-tree 1 admin-edge-port
spanning-tree 1 bpdu-protection
spanning-tree 10 admin-edge-port
spanning-tree 10 root-guard bpdu-filter
spanning-tree Trk2 priority 4 bpdu-protection
spanning-tree Trk3 priority 4 bpdu-protection
spanning-tree Trk4 priority 4 bpdu-protection
spanning-tree Trk8 priority 4 bpdu-protection
spanning-tree Trk9 priority 4 bpdu-protection
spanning-tree instance 1 vlan 1
spanning-tree bpdu-protection-timeout 5 force-version rstp-operation
no tftp server
loop-protect trap loop-detected
no dhcp config-file-update
no dhcp image-file-update
password operator

Neptune(eth-1)# display this
interface 1
   name "Epson I0517 10.1.36.135"
   tagged vlan 18
   untagged vlan 1
   spanning-tree admin-edge-port
   spanning-tree bpdu-protection
   exit
interface 2
   name "PC DIRECTEUR U1084 "
   untagged vlan 1
   trunk trk2 lacp
   exit
interface 3
   name "PRISE PC 2 DIR BUREAU PROCHE ESCALIER"
   untagged vlan 1
   trunk trk3 lacp
   exit
interface 4
   name "TEL ET PC"
   untagged vlan 1
   trunk trk4 lacp
   exit
interface 5
   name 'ECRAN TACTILE MSI PRISE "BORNE" '
   untagged vlan 1
   exit
interface 6
   name "BADGEUSE BGTT037 NEPTUNE "
   untagged vlan 1
   exit
interface 7
   name "BADGEUSE BGTT018 LACORE"
   untagged vlan 1
   exit
interface 8
   name "TEL ET PC"
   untagged vlan 1
   trunk trk8 lacp
   exit
interface 9
   name "TEL ET PC"
   untagged vlan 1
   trunk trk9 lacp
   exit
interface 10
   name "LIEN VERS LACORE"
   tagged vlan 18,112,130,155,212
   untagged vlan 1
   spanning-tree admin-edge-port
   spanning-tree root-guard bpdu-filter
   exit
interface Trk2
   tagged vlan 18
   untagged vlan 1
   spanning-tree priority 4 bpdu-protection
   exit
interface Trk3
   tagged vlan 18
   untagged vlan 1
   spanning-tree priority 4 bpdu-protection
   exit
interface Trk4
   tagged vlan 18
   untagged vlan 1
   spanning-tree priority 4 bpdu-protection
   exit
interface Trk8
   tagged vlan 18
   untagged vlan 1
   spanning-tree priority 4 bpdu-protection
   exit
interface Trk9
   tagged vlan 18
   untagged vlan 1
   spanning-tree priority 4 bpdu-protection
   exit​

Is the configuration of the 1st compliant with the level of network loops and broadcast storms ?

cordially

[drk787]

@DSI-SRT 

Hi,

What do you seen in the logs when you face the issue. If any one has access to the device before rebooting the device, they can check the show logging output to see the last events. May be collecting 'show tech all' output would be good to trobleshoot before rebooting the device. Also you mentioned you have two others HPE5130-48G-PoE  switches, how are the connected to these Aruba 2530 switches.

As you are suspecting network loop, may be you can share the connectivitiy diagram with interface numbering. 

[parnassus]

Hi! it's not clear who is connected to who...it seems you have two eight ports Aruba 2530 not just one.

On the first configuration file we see that:

• interface Trk1 is untagged member of VLAN 1 and tagged member of VLAN 3,18-19,27,120 and 155
• interface Trk1 is the aggregation of ports 9 and 10 by using Non Protocol (Static=trunk in HP ProCurve jargon -> trunk 9-10 trk1 trunk)

Can you clarify?

We don't recognize any other link aggregation (Port Trunking) with the same VLAN membership pattern.

Moreover seeing:

trunk 2 trk2 lacp
trunk 3 trk3 lacp
trunk 4 trk4 lacp
trunk 8 trk8 lacp
trunk 9 trk9 lacp

which is not totally reasonable: why just one port if you then use the LACP on the supposed link aggregation? I mean...one port is there...and the other? usually lacp (and static trunk) is used to aggregate two or more ports together...not to form a single port logical interface. Pretty much nonsense.

Could you provide a network topology map with involved switches, their uplinks and VLAN tagging memberships on relevant links (uplinks). How is configured the Spanning Tree? who is the switch designated as Root of the Spanning Tree? is the STP configuration adopted on Comware based 5130 consistent with that one adopted on the Aruba 2530?

[DSI-SRT]

Hello,

Sorry for the late response.

Here is the network diagram with all the equipment involved:
- 2x HPE FF 5940 4-slot (core network)
- 2x HP 5130-48G-PoE -4SFP in stack (right)
- 1x HP 5130-24G-PoE -4SFP (left)
- 2 Aruba 2530-8G-PoE (right and left)

I had tried to adapt the configuration of the HPE 5130 for the Aruba 2530-8G-PoE. This is why there is a difference in configuration between the 2 Aruba

For the Aruba switch on our site (right), there are ports 9 and 10 which are not in LACP.

The network arrives on port 10 and port 9 allows us to connect the switches in preparation (configuration, ...)

From what I understand, we mis-configured the remote Aruba switch (left).