04-25-2015 03:23 PM - edited 03-07-2019 11:44 PM
I am trying to add a new C2950-4 switch to ASA but some for reason the nearby 2950-2 will get shutdown due to spanning tree messages as soon as the interface is active.
ASA Port 1 is connected to a daisy-chain style C2950s and ASA port 2 is connected a brand new C2950-4 switch with nothing attached.
ASA
0/1-->C2950-2
interface Ethernet0/1
description SW1-0/23
switchport access vlan 100
0/2-->C2950-4
description SW4-0/47
switchport trunk allowed vlan 50,80,100,800
switchport mode trunk
shutdown
SW1
# sh run int fa 0/23
interface FastEthernet0/23
description uplink-rch01-0/1
switchport access vlan 100
switchport mode access
switchport nonegotiate
mls qos trust dscp
auto qos voip trust
macro description cisco-router
end
#sh spanning-tree summary
Switch is in pvst mode
Root bridge for: none
EtherChannel misconfig guard is enabled
Extended system ID is enabled
Portfast Default is disabled
PortFast BPDU Guard Default is disabled
Portfast BPDU Filter Default is disabled
Loopguard Default is disabled
UplinkFast is disabled
BackboneFast is disabled
Pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0100 0 0 0 10 10
---------------------- -------- --------- -------- ---------- ----------
1 vlan 0 0 0 10 10
#sh cdp nei | in 2950
Fas 0/24 157 S I WS-C2950G-Fas 0/23
#sh run int fa 0/23
Building configuration...
Current configuration : 214 bytes
!
interface FastEthernet0/23
description uplink-rch01-0/1
switchport access vlan 100
switchport mode access
switchport nonegotiate
mls qos trust dscp
auto qos voip trust
macro description cisco-router
end
SW4
Interface FastEthernet0/47
description UPLINK-RCH01-0/2
switchport trunk allowed vlan 1,50,80,100,800
switchport mode trunk
Error Messages
Apr 25 17:55:31: %SPANTREE-7-RECV_1Q_NON_TRUNK: Received 802.1Q BPDU on non trunk FastEthernet0/23 VLAN100.
Apr 25 17:55:31: %SPANTREE-7-BLOCK_PORT_TYPE: Blocking FastEthernet0/23 on VLAN0100. Inconsistent port type.
04-25-2015 10:53 PM
It appears that the ASA is bridging BPDUs. By design, an access interface should not received tagged BPDUs; if it does, it implies that you have a misconfiguration with one side of an interface configured as a trunk and the other side as an access switch port. When this happens, on receipt of the tagged BPDU, the access port is blocked with the error messages that you see in your situation.
I believe the ASA in transparent mode bridges BPDUs silently but I could be wrong. I'm not great with ASAs.
Regards,
Aninda
05-09-2015 12:00 PM
Aninda,
Thanks. I will open a TAC case on the ASA. I don't have coverage on the switches so hopefully it is the issue.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide