problems with 3rd party transparent mode device on Procurve router

[Bruce Campbell_3]

We use Procurve 3500yl/5400zl routers,
and are trying to add a 3rd party
transparent mode device, in this
case a Cisco ACE 4710 server load balancer.

It appears the Procurve switch gets confused when
it sees the same MAC address on 2 vlans, as
would be the case with a transparent mode
device bridging 2 vlans.

We can get it to work if we use the ACE
in routed mode, or if we use the HP device
in purely layer 2 mode (no routing). In that
latter case, the HP is fine when it sees the
same MAC on 2 vlans.

I've put additional information here,
including how to replicate this. We haven't
opened a case yet.

https://strobe.uwaterloo.ca/~twiki/bin/view/ISTNS/ProcurveL2L3Table

[Tabasco]

Are both the routes on the 3500/5400 default for their respective vlans? Being the case, it sounds as if the issue has to do with the CPU engine getting confused when it needs to route and sees a mac pop up differnt vlan ports. I have seen this before. It was noted as an ASIC limitation. You can try setting the client default route to be a device upstream of the 3500. That should work and confirm my guess.

[Marcus J]

Hi,

Yes i have seen the exact same thing trying to install a juniper device in transparent mode.
I ended up using it i routemode instead.

The problem would be solved if you could change the mac address on the interfaces on the cisco, but i don't know if this is possible when used in transparent mode.

Would be interesting to see if this setup would work on any other brand of switch, 3com, cisco or whatever?

[Bruce Campbell_3]

I've confirmed Procurve works if the route
point is upstream of the 3500yl doing
the bridging. But, if the bridged
vlans traverse the Procurve doing
the routing, it fails.

I've also confirmed that a Cisco 3750
works fine doing bridging and routing
simultaneously. Cisco config and
results added to:

https://strobe.uwaterloo.ca/~twiki/bin/view/ISTNS/ProcurveL2L3Table

[Tabasco]

The problem replication you have is great. I suggest you open a case with support, give them the replication information, and insist they fix it. If they claim it is a hw/asic limitation, insist they explain to you in detail why it is a limitation of the device. Definately point out that Cisco doesnt have this problem. That will get you the most comprehensive answer possible. (Don't let them push back on giving you details) Once you find out, please post here for our education.

[Bruce Campbell_3]

I opened a case (3604783742) and was advised
the Procurve supports a single layer 3
forwarding database, and would not support
this environment.

But, I did some more tests, and found
the Procurve does in fact support the same
MAC on different vlans, for both layer
2 and layer 3.

ProCurve Switch 3500yl-48G# show arp

IP ARP table

IP Address MAC Address Type Port
--------------- ----------------- ------- ----

129.97.142.100 00188b-d0bdfb dynamic 11
129.97.14.100 00188b-d0bdfb dynamic 35


Details added to end of:

https://strobe.uwaterloo.ca/~twiki/bin/view/ISTNS/ProcurveL2L3Table

This suggests the ASIC can support the
environment, but there may be a firmware
bug related to populating the ARP table,
when the same MAC/IP combination appears
on 2 vlans. (This recent test saw the
same MAC, but different IPs, on the 2 vlans)

[Matt Hobbs]

Bruce, I think you can workaround this issue by setting a different mac-address for one of your VLAN interfaces.

5400(vlan-1)# ip-recv-mac-address
MAC-ADDR The L3-mac-address to be associated with a VLAN.

I had to do this once for a similar transparent proxy/filtering device and it worked very nicely.