topic Re: FTD - BPDU & MAC Address Flapping in Network Security

FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 01:15:06 GMT

Scenario - 3850 Fiber Distribution switch that feeds 5 locations. Ports TE3/0/1-TE3/0/5 go to buildings 1-5. Port TE3/0/12 is the uplink to the Core switch which then connects to my router. This is a flat network topology with a subnet of 172.16.0.0/16 (Vlan 16) and Management network of 10.1.254.0/24 (Vlan 254). From the 3850 switch all links are trunks with both networks (Vlan 16 & Vlan 254). At all 5 locations I've installed an FTD 1010 in transparent mode. Interface vlans have been created as well as the BVI's and all looks good at the FTDs in the FMC, etc.

On my 3850 I'm seeing MAC Address flapping between any of the TE3/0/1-5 ports and the TE3/0/12 port with the mac address of my router. I'm also seeing spanning-tree port blocking on these ports TE3/0/1-5, but not on all of them all of the time.

There are no network loops, this is a very simple topology. If I physically remove the FTD's from the topology all goes back to normal and works...no MAC address flapping or spanning-tree blocks.

I've done a bit of research but haven't come up with a solid solution. Anyone have any thoughts here?

Thanks in advance,

Mark

Re: FTD - BPDU & MAC Address Flapping

MHM Cisco World — Wed, 10 Jan 2024 21:40:29 GMT

sorry can you draw the topology
thanks
MHM

Re: FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 01:16:27 GMT

Hello MHM,

I edited my post and added a diagram. Please take a look and let me know if you have any questions.

Mark

Re: FTD - BPDU & MAC Address Flapping

Marius Gunnerud — Thu, 11 Jan 2024 07:35:37 GMT

Have you verified the spanning-tree topology, that the siwtch in core is the root bridge and no other switch is trying to take over the role of root?

Re: FTD - BPDU & MAC Address Flapping

MHM Cisco World — Thu, 11 Jan 2024 11:24:13 GMT

what is vlan between FTD and SW and between FTD and core SW
MHM

Re: FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 14:57:38 GMT

Both are trunks with VLAN 16 and VLAN 254.

Re: FTD - BPDU & MAC Address Flapping

MHM Cisco World — Thu, 11 Jan 2024 15:45:43 GMT

but the FTD is transparent mode and the VLAN need to be different
the INside VLANx the OUTside VLANy
the FTD change the NAT tag when frame pass through the FTD
I think this make loop in your network.
MHM

Re: FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 15:11:39 GMT

CORE_SW config and output.

spanning-tree mode rapid-pvst
spanning-tree extend system-id
spanning-tree vlan 1,16-17,25,99-100,190,254,999 priority 24576

only spanning tree configuration on ports are "spanning-tree portfast" where an end device like a workstation is connected.

Here is the output for: show spanning-tree summary

CORE_SW#show spanning-tree summary
Switch is in rapid-pvst mode
Root bridge for: VLAN0001, VLAN0016-VLAN0017, VLAN0025, VLAN0100, VLAN0190
VLAN0254, VLAN0999
EtherChannel misconfig guard is enabled
Extended system ID is enabled
Portfast Default is disabled
PortFast BPDU Guard Default is disabled
Portfast BPDU Filter Default is disabled
Loopguard Default is disabled
UplinkFast is disabled
BackboneFast is disabled
Configured Pathcost method used is short

Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001 0 0 0 3 3
VLAN0016 0 0 0 42 42
VLAN0017 0 0 0 2 2
VLAN0025 0 0 0 3 3
VLAN0100 0 0 0 2 2
VLAN0190 0 0 0 3 3
VLAN0254 0 0 0 3 3

Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0999 0 0 0 1 1
---------------------- -------- --------- -------- ---------- ----------
8 vlans 0 0 0 59 59

Fiber_Dist_SW config and output.

spanning-tree mode rapid-pvst
spanning-tree extend system-id

no configuration on ports for spanning-tree.

Here is the output for: show spanning-tree summary

Fiber_Dist_SW#show spanning-tree summary
Switch is in rapid-pvst mode
Root bridge for: none
EtherChannel misconfig guard is enabled
Extended system ID is enabled
Portfast Default is disabled
PortFast BPDU Guard Default is disabled
Portfast BPDU Filter Default is disabled
Loopguard Default is disabled
UplinkFast is disabled
BackboneFast is disabled
Configured Pathcost method used is short

Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001 0 0 0 2 2
VLAN0016 0 0 0 5 5
VLAN0025 0 0 0 2 2
VLAN0190 0 0 0 3 3
VLAN0254 0 0 0 3 3
---------------------- -------- --------- -------- ---------- ----------
5 vlans 0 0 0 15 15

The ports with FTD's connected are currently shut. If I enable more than 1 of those ports all heck breaks loose and spanning-tree blocks ports and vlans. It seems to be something coming from the FTD's... perhaps the bridge BVI? Since its mimicking a switch might there be some BPDUs coming from the FTDs that are causing the issue?

Re: FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 15:22:21 GMT

It is running in transparent mode.. there is no NAT running on the FTD. I configured the interfaces in the following manner.

Re: FTD - BPDU & MAC Address Flapping

MHM Cisco World — Thu, 11 Jan 2024 16:14:11 GMT

I know friend you already reply to my Q
but that wrong
you need to specify the VLAN different

Re: FTD - BPDU & MAC Address Flapping

Marius Gunnerud — Thu, 11 Jan 2024 16:23:33 GMT

@MHM Cisco World is correct here, you need to decide which interface goes to the building and which goes towards core and remove then on the Building interface you have only the VLANs specific for the building and remove the VLAN that is for the core. Then do the opposite for the interface connected to core, remove the building VLANs and keep the core VLANs.

Re: FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 16:28:21 GMT

Ok, so let me see if I understand what you are saying.

My understand is that one of the benefits of using FTD in transparent mode is that you can insert it into the network without having to make changes to your current network.

Are you saying I need to change the vlan on the INSIDE switch to a different VLAN or just from the INSIDE/OUTSIDE interface on the FTD? I'm not quite following you here. If I have to make changes to my inside network switches then this isn't a good solution.

Re: FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 16:30:48 GMT

I'm not following what you are saying here... I need both VLANs going to the core and to the building. VLAN 16 is my data for the building and VLAN 254 is my management VLAN.

Re: FTD - BPDU & MAC Address Flapping

Marius Gunnerud — Thu, 11 Jan 2024 18:18:11 GMT

You dont need to make changes to the IP subnet setup is what is meant with not needing to make changes. There does need to be some L2 changes, but that is minor compaired to having to setup new subnets.

OK so if you need both then you would need separate VLANs for each on the building side.

for example. If VLAN 16 (data) and VLAN 254 (MGMT) are in the core you would need to "map" them to separate VLANs on the building side, lets say VLAN 15 (data) and VLAN 253 (MGMT) for this example. This is done by assigning each interface a separate VLAN but binding them to the same BVI interface.

So on core switch side of the FTD you would have VLAN 16 and VLAN 254, then on the building side you would have VLAN 15 and VLAN 253.

Re: FTD - BPDU & MAC Address Flapping

MHM Cisco World — Thu, 11 Jan 2024 18:24:25 GMT

CoreSW-trunk allow vlan 16,254-OUTside_FTD_INside-trunk allow vlan 116,354-accessSW
only change the vlan in access SW NOT Change the Subnet.
the accessSW subnet x.x.x.x for vlan 116 is same subnet of vlan 16 in CoreSW and etc.
this way the FTD not (So change) your network.
only do this in one FTD and check it.
MHM

Re: FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 18:29:24 GMT

Ok, so if I am understanding you correctly, I'd leave the following as is since I already have interface vlans for 16 and 254 bound to the BVI and e1/1 (Outside) is set as a trunk with vlan 16, 254 coming from the CORE.

On the FTD I'd add interface vlans for 15 and 253, then add those to the BVI. Also make sure to change e1/8 (Inside) from trunk with vlan 16 and 254 to trunk with vlan 15,253. I assume I'd have to change the trunk at the building switch to allow 15 and 253 and then change the ports on the switch to access for 15 or 253 respectively. Am I missing anything? So the FTD would map the vlans correctly within the BVI based on the subnet?

Re: FTD - BPDU & MAC Address Flapping

MHM Cisco World — Thu, 11 Jan 2024 18:38:54 GMT

you can use any VLAN in trunk between the AccessSW and FTD
but you must use one BVI for each two VLAN
i.e. VLAN16 and VLAN15 use BVI1
VLAN254 and VLAN253 use BVI2

here the Access SW send frame tag with VLAN15 and FTD remove this tag (after inspect) and tag again with VLAN16 and forward it to CoreSW

MHM

Re: FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 18:42:08 GMT

Ok, this make sense now. 🙂 I'll give this a try and let you know the results.

Re: FTD - BPDU & MAC Address Flapping

MHM Cisco World — Thu, 11 Jan 2024 18:44:04 GMT

friend do this in one ftd and then in two ftd and check the STP and Loop
good luck friend
MHM

Re: FTD - BPDU & MAC Address Flapping

MarkNode17 — Thu, 11 Jan 2024 18:53:39 GMT

Do i need an ip on each BVI within the respective subnet?