10Gig (tengigabit) CRC Errors between N5K500 and 3750X

[Michael Weller]

Dear Forum,

We have an issue with a 10 Gig connection between a Nexus 5548 and a 3750X 10Gig. There is also a HSRP group running over this link with aggressive timeouts which recently behaves somewhat unstable. We noticed a bunch of CRC errors on this link on the 3750X side (about 300 per hour) and assume that these are related to the HSRP troubles once or twice a day.

Originally the connection was made with a twinax cable. We already changed to MMF fiber with SR SFP+'s. The 10Gig Uplink Module in the 3750x has been replaced already. All to no avail. Now it's up to replace the 3750 (receives CRC) or the Nexus Chassis (sending device)

I was wondering if there is some experience on the list what is the most probably cause and solution here.

Thanks in advance,

Michael.

[Michael Weller]

Hello Cory, hello list..

It's good that you remind me of this thread, so I can actually post the solution. It's not directly related to the 3750 at all.

TAC analysed a wireshark capture and noticed a bunch of DTP packets with vlan tags.

DTP packets are not allowed to have vlan tags, so the 3750 complains about this framing error. Due to the asic and IOS design of the 3750, those errors are actually counted as CRC errors, even though it's not strictly a CRC error. The 3750 also drops these malformed packets.

The misleading behaviour of the 3750 is already known and documented:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCdz33708

This leads us to the question where these packets originated:

Through a chain of Nexus Switches (5k and 7k) a few other IOS Switches have been connected to the network.

The nexus does not support DTP or dynamic trunking configuration. The Nexus Port was configured as switchport mode access within some vlan.

The IOS Switch had its port more or less in default configuration, most important: switchport mode dynamic. This switch now sends out DTP packets every now and then to possibly negotiate a trunk. The Nexus does not understand DTP and forwards these packets as ordinary packets in the access-vlan. All Nexus in the chain just forward these packets like any other data frame. Then they are forwarded through a trunk to the DTP aware 3750...

As a solution, 'switchport mode access' was configured in the switches connected to the access ports of the N7K. You should search for similar ports in your setups. Nexus/newer IOS Switches tend to complain about mismatching VLANs in CDP even when two access-ports are connected. This might be a hint to you, at which ports to look. Finally, you could make a packet capture on the uplink, looking for the tagged DTP frames and search for the source mac in your network.

I'm sure this will resolve your issue.

Regards,

Michael.

[Mark Walters]

Hi All -

It's my understanding that setting the port to "switchport mode access" does not actually stop DTP advertisements - it likely just removed the VLAN tag in this scenario.  "switchport nonegotiate" ceases DTP advertisements altogether.

Cheers

Mark