3560 interface utilization troubleshooting

david-flores · ‎08-08-2011

Dear Expert Community,

I have an unusual swithport interface occurence happening. I am hoping somebody can point me in the right direction to solve this issue. I have 2 Catalyst 3560G-48TS switches running HSRP between each other in a DMZ which is behind 2 Checkpoint firewalls that are connected internally to a 6509. There are approx. 40 server connections between these 2 switches. Most of the servers are running a 1GB/fd with approx. 4 of the connections running at 100mb/fd, one of those connections is a L2 2950 switch uplink port. The strange thing is every 100mb port has almost the same exact amout of total output drops, and this number increments the sames on all the 100mb ports even after every issue of the clear counters command. I even noticed that 1 of those 100mb connection is connected to a windows server where the nic is disabled on the server level, but the link is up on the switch, and this port has the same number of total output drops as the others. This port, as well as the others will average about a 20Mbps transmit utilization, and even spike up to 100mb at any random time. Not sure what is going on, but need some direction.

Thanks in advance for the help.

Antonio Knox · ‎08-08-2011

I would start by checking the ports connecting to these servers to make sure that they are properly configured per spanning-tree best practices. The overall consistency of the drops are very suggestive, so I would make sure that there are no spanning tree issues here.

Leo Laohoo · ‎08-08-2011

Most of the time "output drops" means that the switch is pushing as much traffic as it's interface can but the remote end is "throwing up" or dropping (hence the term ouput drop).

david-flores · ‎08-09-2011

That makes sense, but upon on one instance of these interfaces with drops, the other end of the link is disabled, so something else must be causing the 100mb ports to drop. Just can't seem to figure out what. Might have something to do with the Checkpoint firewall cluster mode settings.

Leo Laohoo · ‎08-09-2011

That makes sense, but upon on one instance of these interfaces with drops, the other end of the link is disabled, so something else must be causing the 100mb ports to drop.  Just can't seem to figure out what.  Might have something to do with the Checkpoint firewall cluster mode settings.

About two months ago, I was asked to link a new Exchange server's 8 links to our 3750X. Being new they have GigabitEthernet interface so I put my links in auto speed. One week later and we saw output drops by the bucket load.

We told the guy managing the box and he throttled his server down to 100/Full duplex and output drops stopped.