topic Problem with MAC learning on ASA, MAC moving between two bridge-groups in Network Security

Problem with MAC learning on ASA, MAC moving between two bridge-groups

silemire — Mon, 11 Mar 2019 20:53:00 GMT

Hi,

I'm running an ASA 5585 pair in transparent mode with two bridge-groups inside one context. The ASA is connected to a 6500 switch in VSS.

In the logs, I'm seeing the MAC of the VSS cluster moving between between the two outside interfaces of my two bridge-groups (same context). So, my traffic is getting dropped intermittently, as the ASA doesn't flood traffic on an unknown MAC.

For this particular problem, I've assigned MACs manually to the SVIs of the 6500.

However, I still have the same problem with routed multicast traffic going to a firewalled VLAN. The 6500 PFC always uses the VSS MAC when it rewrites the L2 packet header so it's not using the MAC I've specified on the SVI.

Is there any way to fix this? Should I be only using one bridge-group per context?

-Simon

Problem with MAC learning on ASA, MAC moving between two bridge-

mirober2 — Thu, 30 Jun 2011 14:56:16 GMT

Hi Simon,

This issue is caused by the following bug:

CSCti13482 - BG: Same MAC-address not allowed in two different bridge groups

You should upgrade to 8.4(2) to get the fix for the bug and everything should work fine.

-Mike

Problem with MAC learning on ASA, MAC moving between two bridge-

silemire — Thu, 30 Jun 2011 16:15:12 GMT

Thanks Mike,

I will upgrade my ASA as soon as possible.

-Simon