STP disconnect firewall LAN port

Toggle sidebar Toggle sidebar
P

pimpo

Honorable
Sep 29, 2014
43
0
10,530
Hello,

We have a firewall connected in one HP procurve 2610 switch port
and another to an internal switch procurve HP 2910. In the first switch (2610) we have
connected the router and in 2910 HP the servers and other final client PCs switches (stacked 2610)
Among all the switches is enabled MRSTP.
It's happened a few times a very strange effect is that LAN firewall port (connected to
2910) stops working and the light from port of the internal switch is turned off.
Removing and reconnecting the cable to the switch will fix the problem, which seems rather odd.
The firewall is a Dell PowerEdge Linux Lince and Ethernet Dual Port Broadcom 5720 NetStreme 100 Mbps card.
The logs of HP2910 shows the following sequences of these events repeated several times:

- Port X is now off-line
- Port X is Blocked by STP
- Port X is now on-line
-ffi: Port X-Excessive Broadcasts. See help.
- Port X is now off-line
- Port X is Blocked by STP

where X is the LAN port on the firewall, ie the STP blocking port.
I checked cables between switches that the firewall is connected
and there is no physical loop.
On the other hand the situation, using switches commands, is characterized by:
-there is no change of STP topology
-topology changes counter doesn't increase
-STP on the switch blocks LAN firewall port
Software releases are: W.14.03 for 2910 and R.11.25 for 2610. I checked fixes but I
couldn't find any related with MRSTP or Broadcom NICs. Does anybody what's happening?

Best Regards and thanks in advance.
 
Solution
B
Its hard to say why it thinks 2m broadcast is excessive. It is less than 1% of all traffic which is pretty normal. Maybe there is a switch setting that is set too low. You likely can disable this feature that is looking for excessive broadcast,I forget exactly how on procurve. Tends to be a risky thing to do if there really are broadcast packets.
Sort by date Sort by votes
B

bill001g

Titan
Aug 9, 2012
28,363
2,766
125,640
If it actually is blocking because of spanning tree it is seeing a BPDU come in the wrong port....or it may see a bpdu on a edge port if you have it configured as a edge.

The firewall has to be guilty but it is hard to say. Almost impossible to guess.

I would take a pc running wireshark and define a port mirror for the port to the firewall that is causing the issue. If you have a actual loop you should be able to see it and the traffic that should not be on the port.
 
Upvote 0 Downvote
P

pimpo

Honorable
Sep 29, 2014
43
0
10,530


Hi bill001g,

Thanks for your answer. So STP blocks the port because there is a bdpu in the wrong port. No edge ports are defined, ie MSTP is working in all ports. My question is, when this happen, I mean if it is working along all the year and one day suddenly you have this situation, how is possible?
 
Upvote 0 Downvote
B

bill001g

Titan
Aug 9, 2012
28,363
2,766
125,640
The firewall must be leaking packets between the 2 interfaces. Hard to say it depends how complex your install is. You can have issues if you do not have a consistent vlans on all the trunk ports and some vlans block and other do not because of the devices get confused. BUT you would have to be running with port tagging on the port to the firewall.
 
Upvote 0 Downvote
P

pimpo

Honorable
Sep 29, 2014
43
0
10,530
Hi bill001g,

We don't have vlans, only one, ie the default one. My question is, when this happen, I mean if it is working along all the year and one day suddenly you have this situation, how is possible?
 
Upvote 0 Downvote
P

pimpo

Honorable
Sep 29, 2014
43
0
10,530

Sorry bill. Firewall configuration is stable, I mean we don't change parameters of the system or nics, only filter rules using a graphical console that we after transmitt. So what do you mean by:
"I would be suspect of some setting getting changed in the firewall"
 
Upvote 0 Downvote
B

bill001g

Titan
Aug 9, 2012
28,363
2,766
125,640
You don't have many options. It is either the switch is defective and you are not really getting broadcast storms and spanning tree messages into the port or your firewall is actually sending traffic to the switch on that port that is causing the problem.

A switch is pretty simplistic is why I would be suspect of the firewall.
 
Upvote 0 Downvote
P

pimpo

Honorable
Sep 29, 2014
43
0
10,530
Hil bill,

Thanks again. About the question point this:

1) The logs of HP2910 shows the following sequences of these events repeated several times:

- Port X is now off-line
- Port X is Blocked by STP
- Port X is now on-line
-ffi: Port X-Excessive Broadcasts. See help.
- Port X is now off-line
- Port X is Blocked by STP

where X is the LAN port on the firewall, ie the STP blocking port.

2) Counters for firewall LAN X port blocked by STP

Totals (Since boot or last clear) :

Bytes Rx : 2,948,646,096 Bytes Tx : 1,937,188,467

Unicast Rx : 3,501,949,778 Unicast Tx : 2,725,757,392

Bcast/Mcast Rx : 2,407,356 Bcast/Mcast Tx : 96,320,597

Errors (Since boot or last clear) :

FCS Rx : 1 Drops Tx : 34,918

Alignment Rx : 0 Collisions Tx : 0

Runts Rx : 0 Late Colln Tx : 0

Giants Rx : 0 Excessive Colln : 0

Total Rx Errors : 1 Deferred Tx : 0

Others (Since boot or last clear) :

Discard Rx : 0 Out Queue Len : 0

Unknown Protos : 0

Rates (5 minute weighted average) :

Total Rx (bps) : 0 Total Tx (bps) : 0

Unicast Rx (Pkts/sec) : 0 Unicast Tx (Pkts/sec) : 0

B/Mcast Rx (Pkts/sec) : 0 B/Mcast Tx (Pkts/sec) : 0

Utilization Rx : 0 % Utilization Tx : 0 %

What do you think?
 
Upvote 0 Downvote
B

bill001g

Titan
Aug 9, 2012
28,363
2,766
125,640
Its hard to say why it thinks 2m broadcast is excessive. It is less than 1% of all traffic which is pretty normal. Maybe there is a switch setting that is set too low. You likely can disable this feature that is looking for excessive broadcast,I forget exactly how on procurve. Tends to be a risky thing to do if there really are broadcast packets.
 
Upvote 0 Downvote
Solution
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom