HP 5120 ARP Issue

[ATAHER]

Dear All,

i have one Core Switch 7506 and seven 5120 Switches are connected to the core Switch using Fiber Connection with single Cable. suddenly when i was wroking on the switches i got deisconnected from the network and i can't ping to the core or any switch, it gave me request time out then it ping twice then again request time out.

when i connected through the console on one switch i found one messages coming quickly

"  %Jul 21 02:18:11:549 2014 SW-FF-02 ARP/5/ARP_DUPLICATE_IPADDR_DETECT: Detected an IP address conflict. The device with MAC address cc3e-5fde-c296 connected to GigabitEthernet1/0/9 in VLAN 20 and the device with MAC address cc3e-5fde-c296 connected to Ten-GigabitEthernet1/1/1 in VLAN 20 are using the same IP address 172.16.0.1. "

172.16.0.1 is the core switch,  and there is no one os connected to the network. also if you check the MAC address you will find it the same.

so please help me ASAP.

[manuel.bitzi]

Looks like a loop. Please post your configs and network topology.

br

Manuel

[Vince-Whirlwind]

On the switch that is having the issue, issue a "display lldp neigh" and see what you see...

[ATAHER]

i found one swith with two connection to the core switch, ihave removed one connection to the core now it is normal.

but stil i have one issue when i checked the logs i got the below message and it always coming

" MSTP/6/MSTP_DETECTED_TC: -Slot=2; Instance 0's port Ten-GigabitEthernet2/0/7 detected a topology change. "

what does it mean and how i can resolve this issue.

[Vince-Whirlwind]

Question: What is the core switch's STP config?

Here are a few suggestions:

1/ Network diagram:

      a. include switchport IDs - record them at each end of each critical link.

      b. In the middle of the link line, record all the VLANs allowed on that trunk.

      c. Each device should have its Device Name recorded in addition to management IP address

2/ Switchport configs: include a Description consisting of DeviceName/RemoteSwitchportID for critical interfaces - uplinks and servers.

3/ When posting configs on the internet, get rid of passwords and SNMP details before posting.

[ATAHER]

i found STP is disabled on the core switch

[Apachez-]

Either you setup a loop-free environment (like using IRF, Portchannels etc) and/or you enable STP.

Note however that STP on its own has issues too.

A common recommendation and quickfix in your case should be to enable RSTP on all devices (rapid spanning tree). This way you have a much shorter time to get a link but also shorter convergence times (default in regular STP is 35ish seconds of downtime, while with rapid its down to a few seconds).

You can also add more aggressive timers to make RSTP even faster, also setting a manual priority on your core might be a good idea aswell (not that the priority value is increased by 4096 if I recall it correctly).

That is put this on Core1:

 stp mode rstp
 stp instance 0 priority 0
 stp timer hello 100
 stp timer forward-delay 400
 stp timer max-age 600
 stp enable

and this on Core2 (if you got such):

 stp mode rstp
 stp instance 0 priority 4096
 stp timer hello 100
 stp timer forward-delay 400
 stp timer max-age 600
 stp enable

Then on the other switches just:

 stp mode rstp
 stp timer hello 100
 stp timer forward-delay 400
 stp timer max-age 600
 stp enable

Another optimization is to enable "portfast" on interfaces that you got a client or server directly connected at, that is on each such interface:

stp edged-port enable

This way the STP transition will "assume" this interface is loopfree and go straight to forwarding state (basically working within a second instead of waiting a few seconds as with RSTP). However if a BPDU (STP frame) arrives it will do the regular transition and not forward any traffic while it listens for other BPDUs and then decide if this interface can continue to forward traffic or if a loop occured and the interface should be in blocking (and listening) mode.

[Vince-Whirlwind]

Excellent advice from Apachez.

[Apachez-]

Another good advice might be to implement broadcast suppression on all interfaces (both downlink and uplink) to a value small AND large enough for your environment.

This is what I use for my interfaces:

broadcast-suppression pps 100
multicast-suppression pps 100
unicast-suppression pps 100

Broadcast-suppression is pretty straight forward, pps means packets per second (there are other syntax to choose from).

Since I dont do multicast in my network (IPTV and such) I throttle those packets aswell - beware that some dynamic routing protocols use multicast when they communicate.

Unicast-suppression means unicast packets where the switch doesnt know where the mac address is located (no hit in mac-address-table) and therefor it will flood these packets on all interfaces which belongs to the same VLAN except the interface the packet arrived at (also known as DLF - Destination Lookup Failure).

This way IF a loop occurs then at least broadcast/multicast/unknown unicasts will be throttled to not fully occupy your 10G (or whatever speeds you have) links :-)