PREVENT NETWORK LOOP ON SWITCH

[Slimer11]

A loop on the network frequently occured. The caused of this is usually when an end user accidentally connects a copper cable both ends to the port of the switch. How do we address this? Is there a way that when the switch identify this connection it will autmotically shut down the ports. Model is Procurve HP 1700 and other 2600 model switches.

Thanks.  

[Chrisd131313]

Hi Slimer11,

There are two parts to this one. First off, are you running spanning-tree in your environment? Also do you know if your switches support loop-protect?

Normally I would setup spanning-tree and make use of bpdu-protection on all device ports (all ports end user devices attach to) and also enable "loop-protect <1-48> receiver-action send-disable."

Utilising bpdu-protection with spanning-tree will disable the port if it receives a spanning-tree bpdu packet on it, i.e. someone has created a loop between two spanning-tre enabled switches. If you have unmanaged switches, or you don't have spanning-tree enabled then HP have developed loop-protect. This protocol sends out loop-protect packets in scheduled intervals (every 5secs I believe) and if the switch receives this packet back it disables the port to stop a broadcast storm from occuring. There are other options like timer delays so you can automatically re-enable the disabled port, but to be honest I would always go down the path of completely disabling the port until the problem is fixed.

HTH

[paulgear]

Note that 1700 series switches are unmanaged, and there isn't really anything you can do except turn on BPDU protection or loop protection on the upstream switch.

[Matcol]

as advised above, enable spanning tree on your managed switches, and then on each uplink port that you have an unmanaged switch on, configure a broadcast limit of about 10%:

eg,

int 12 broadcast-limit 10

Maybe more than 10, depending on the speed of the link, but genuine broadcasts should add up to less than 50Kb/s per 10 devices, I think.

[paulgear]

Hi Matcol,

I have found that broadcast limits are not enough to make a substantial difference.  In a campus network of about 70 switches, i had all access ports set to 1 percent broadcast limit, and this still didn't prevent broadcast storms from taking out the network.  Locking down all the access ports to use BPDU protection is the only effective measure, in my experience.

[Matcol]

I was thinking that if you have limited the broadcast traffic from a "looped" unmanaged switch to 10Mb, then at least the managed switch upstream of it is only dealing with that amount of traffic, rather than the full 100Mb?

[Matcol]

...or does the managed switch see its own BPDU when the unmanaged switch is looped? I suppose it should.

[Chrisd131313]

Hi Matcol,

It depends if the unmanaged switch drops BPDU packets or not, if it does then its not going to see the BPDUs and you are going to get your storm, it's this exact scenario when loop-protect comes in to play.

[Davy Priem]

You can also disable autosensing on the switch access ports. You normally use straight cables to connect pc's to the network and when someone makes a loop on the switch with a straigh cable, your network won't be affected.

[paulgear]

Hi Chris,

Which models of unmanaged switch have you seen drop spanning tree BPDUs?  I have not yet found any unmanaged switch which does this.

[Chrisd131313]

Hey Paul,

Personally I have not come across any myself, but based on HPs documentation this seems to be something that can occur...

Spanning tree cannot detect the formation of loops where there is an unmanaged device on the network that does not process spanning tree packets and simply drops them. Loop protection has no such limitation, and can be used to prevent
loops on unmanaged switches.

Maybe I am interpreting the passage incorrectly, if so please ignore my previous comment and set me straight! :)

[paulgear]

Hi Chris,

I agree 100%; i've just never seen an unmanaged switch that dropped BPDUs and was curious which ones they were (so i can avoid them). :-)

[kalyan333]

 hi 

    i have hp 1900 series switches 

       i  have faced a problem while looping these switches in netwrok. these two switches having vlan1(1-9 and 19-28 untagged) and vlan2(10-18 untagged and 19-28 tagged).

switch A ---25 port --- ofc connected to location P

switch B ---25 port ----ofc connected to location Q

P and Q are inter connected to somewhere in network(3com switches).

my problem is iam connecting a loop cable(straight cable) to switch A and Switch B on 24 port one both switches ...then entire n/w goes down...i mean packets drop....

please tell me solutions immediatly... 

[Razt]

Hi guys,

Yes everything people have said is correct however that still doesn't stop anyone from reoming or inserting a cable at the data socket end. There is another alternative called NetLoc,

www.netloc.co.uk

I saw this product and ive managed to get hold of some. it's pretty nifty little gadet and does exaclty what is says on the tin!!

you might want to check it out as it's a great deterrent and works beautifully in my school and a warehouse i look after as it also stops damage and saved me a shed load of money as i don;t need to upgrade my unmanaged switches now to get the beneift of STP.

cheers

Raz