How to filter unnecessary Broadcast Messages? (like VRRP, STP)

[Stefan Priebe]

Hi!

First a short netzwork plan:
Uplink 1 Uplink II
| |
[Foundry]----------[Foundry]
| |
| |
[HP 2824]----------[HP 2824]
| |
| |
-----[HP 2650]-----
|||
MULTIPLE SERVERS

We use VRRP on the Foundry Bigiron for IP failover and RSTP in the whole network.

Now all these broadcastmessages are reaching the servers at the HP 2650 too. So i would like to know if it isn't a security risk and if there is a way to filter them. At the moment it is about 2GB per day per port at the HP 2650.

thanks
Stefan

[Stefan Priebe]

I forgot to click retain format. So here the map again:
Uplink 1 Uplink II
| |
[Foundry]----------[Foundry]
| |
| |
[HP 2824]----------[HP 2824]
| |
| |
-----[HP 2650]-----
|||
MULTIPLE SERVERS

[Tijl van der Steeg]

For RSTP you can use bpdu-filtering
port a5 bpdu-filter etc

Not sure about VRRP.

[Stefan Priebe]

oh yes i forgot about bpdu-filter you're right. But the most problem are the VRRP packets. I thought there must be a filter like block all broadcasts except for ARP or so.

[Pieter 't Hart]

From some VRRP-document:

The master virtual router sends VRRP advertisements to other VRRP routers in the same group. The advertisements communicate the priority and state of the master virtual router. The VRRP advertisements are encapsulated in IP packets and sent to the IP Version 4 multicast address assigned to
the VRRP group. The advertisements are sent every second by default; the interval is configurable.

- So this is multicast, not broadcast.
- you can configure the interval
- you may be able to split into multiple VRRP-groups to separate traffic on the server vlan from other vrrp traffic.

[Tijl van der Steeg]

Cheers I was searching for configuring the interval as well. 5 virtual points :P

[Mohammed Faiz]

So if IGMP was configured on that VLAN that would mean the VRRP advertisements would not be broadcast, yes?

[Pieter 't Hart]

Hi Mohammed,
sometimes it's difficult to use the right terminology.
- So this is multicast, not broadcast
Here the document means TCP/IP-multicasts.

The packet is sent to a TCP/IP multicast address but as there is no entry in the mac-address table of the switch, it wil be sent (flooded not broadcast) to all ports.
IGMP (snooping) is used to prevent a switch from "flooding" a packet (not broadcast) to all ports, but only forward the packets to ports that have subscribed to the corresponding multicast group.

does this help?

[Stefan Priebe]

thanks - how do i define a multicast group on HP 2824? And does this also affects STP or only VRRP?

[Pieter 't Hart]

STP is a layer-2 protocol (mac-based)
VRRP is a layer-3 protiocol (ip-based)

so you need different solutions for both protocols.