Need help on mac address flapping

[kiran_8095]

Hi All,

We have strange situations with users connecting devices having same MAC address to the switch port, basically the end device don't have any burned-in Mac address & the users assign same MAC address before connecting to the network.  This results in L2 Loop & the switch CPU goes high (99 %). I want to know if we can configure the switch, so that the port disables if same MAC address is learned from multiple ports. Network setup is as below

(4503) --> access switches (2960).

Regards,

Kiran                 

[Leo Laohoo]

Can you please post the "sh logs"?

[kiran_8095]

Hi Leo,

Please find the show log

Jul 31 10:17:35: %C4K_EBM-4-HOSTFLAPPING: Host 00:A1:2B:C3:4D:E5 in vlan 218 is flapping between port Gi3/36 and port Gi3/8

Jul 31 10:23:04: %C4K_EBM-4-HOSTFLAPPING: Host 00:A1:2B:C3:4D:E5 in vlan 218 is flapping between port Gi3/36 and port Gi3/8

Jul 31 10:23:04: %C4K_EBM-4-HOSTFLAPPING: Host 00:1C:C3:00:8D:C8 in vlan 218 is flapping between port Gi3/36 and port Gi3/8

Jul 31 10:27:31: %C4K_EBM-4-HOSTFLAPPING: Host 00:00:00:09:70:38 in vlan 215 is flapping between port Gi3/4 and port Gi2/15

Jul 31 10:27:59: %C4K_EBM-4-HOSTFLAPPING: Host 00:00:00:09:70:38 in vlan 215 is flapping between port Gi3/4 and port Gi2/15

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:0C:29:60:5A:C1 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:25:90:4B:89:48 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:1B:21:D2:ED:73 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:1B:21:D2:ED:72 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:1B:21:D2:ED:71 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:33:36: %C4K_EBM-4-HOSTFLAPPING: Host 00:00:00:09:70:38 in vlan 215 is flapping between port Gi2/15 and port Gi3/4

Jul 31 10:34:45: %C4K_EBM-4-HOSTFLAPPING: Host 00:00:00:09:70:38 in vlan 215 is flapping between port Gi3/4 and port Gi2/15

Jul 31 10:17:35: %C4K_EBM-4-HOSTFLAPPING: Host 00:A1:2B:C3:4D:E5 in vlan 218 is flapping between port Gi3/36 and port Gi3/8

Jul 31 10:23:04: %C4K_EBM-4-HOSTFLAPPING: Host 00:A1:2B:C3:4D:E5 in vlan 218 is flapping between port Gi3/36 and port Gi3/8

Jul 31 10:23:04: %C4K_EBM-4-HOSTFLAPPING: Host 00:1C:C3:00:8D:C8 in vlan 218 is flapping between port Gi3/36 and port Gi3/8

Jul 31 10:27:31: %C4K_EBM-4-HOSTFLAPPING: Host 00:00:00:09:70:38 in vlan 215 is flapping between port Gi3/4 and port Gi2/15

Jul 31 10:27:59: %C4K_EBM-4-HOSTFLAPPING: Host 00:00:00:09:70:38 in vlan 215 is flapping between port Gi3/4 and port Gi2/15

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:0C:29:60:5A:C1 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:25:90:4B:89:48 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:1B:21:D2:ED:73 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:1B:21:D2:ED:72 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:28:13: %C4K_EBM-4-HOSTFLAPPING: Host 00:1B:21:D2:ED:71 in vlan 198 is flapping between port Gi2/14 and port Gi3/27

Jul 31 10:33:36: %C4K_EBM-4-HOSTFLAPPING: Host 00:00:00:09:70:38 in vlan 215 is flapping between port Gi2/15 and port Gi3/4

Jul 31 10:34:45: %C4K_EBM-4-HOSTFLAPPING: Host 00:00:00:09:70:38 in vlan 215 is flapping between port Gi3/4 and port Gi2/15

Note: Gi2/14, Gi2/15, Gi3/4, Gi3/36 are connected to cisco 2960 switches.

[Leo Laohoo]

It sounds like you have a loop happening.  Do you have Etherchannel configured?

[kiran_8095]

No. All access switches are configured as Trunk on the interface connected to 4503.

[Joseph Nelson]

Hi Kiran,

Is the user-defined MAC address guaranteed to be the same everytime the user device is connected? Do users move there devices between access switches often (e.g. daily)?

If the host will not change physical ports and the MACs will remain the same, you can use port-security on the access switches. In particular you can use sticky-mac's feature to ensure the first MAC seen on the user port is the only authorized MAC on the port.

A reference can be found here:

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_55_se/configuration/guide/swtrafc.html#wp1038501

You may need a few pieces:

• Set maximum MACs (default = 1 )
• Set violation mode to shutdown

In this situation, the first MAC seen is authorized, the second MAC seen will err-disable the port.

HTH