Cisco C1000 MAC address flapping

[dgiambo1]

We have a problem that doesn't make much sense. We boiled it down to the simplest case. We have 2 C1000 switched, a 24 port and a 16 port. We have port 23 of the 24 port trunked to port 16 of the 16 port. Both ports are configured as 'trunk' mode. 

One PC is plugged into port 13 of the 24 port switch. The logs on the 24 port switch indicate abnormal condition of mac address flapping for the PC MAC:

Aug 22 14:36:41.920: %SW_MATM-4-MACFLAP_NOTIF: Host XXXX.XXXX.c4e7 in vlan 1 is flapping between port Gi1/0/13 and port Gi1/0/23 Aug 22 14:36:32.914: %SW_MATM-4-MACFLAP_NOTIF: Host XXXX.XXXX.c4e7 in vlan 1 is flapping between port Gi1/0/23 and port Gi1/0/13

We have STP enabled and tried every mode on the switches with the same result. Anyone know what could be going on? Both are on the latest IOS release.

[MHM Cisco World]

there is any BPDU filter config in global mode ? this case indicate that there is L2 LOOP 

[dgiambo1]

No BDPU filters are enabled. There cannot be a L2 loop, there's only 2
cables connected. 1 trunk between the 2 switches and 1 PC connected to an
access port on the 24 port switch. 2 Ethernet cables.

[MHM Cisco World]

Check then native vlan in both sw

[dgiambo1]

The native VLAN is 1 on both switches. All ports are set up this way.

[MHM Cisco World]

OK, 
only show mac address table in both SW 
the VLAN for the MAC must be VLAN 1 
I think that the Second SW the VLAN for MAC address is different. 

[dgiambo1]

Both 'show mac address-table' tables on the switches show the MAC as VLAN 1 MAC on the right port, port 13 for the 24-port C1000 and port 16 (trunk) for the 16-port. This problem makes no sense and we need to recommend customers switch to these switches. Having trouble doing this when we can't get a basic configuration not to show errors...

[Jitendra Kumar]

RESOLUTION

A MAC Flap is caused when a switch receives packets from two different interfaces with the same source MAC address.

If you are getting the behavior for a lot of other MACs, that most likely is a layer 2 loop.

You can do the following:

• Check the network switches for misconfigurations that might cause a data-forwarding loop.
• If you are not running spanning-tree, turn it on.
• To track down a loop, start with the following command: #show mac-address-table address [flapping mac] 
• We see that the MAC is coming in on port gi0/5 and gi0/16. One port will lead us to where that MAC is plugged in and the other will lead us to the loop. Pick a port and start working through.
• Or Some load balancing techniques can send traffic to both ports, and that would cause the switch to go crazy, since it is receiving traffic from the same MAC on two or more different ports.
• Fix this type of LB make it active/standby or make sure the server uses 2 different mac addresses, one per NIC.

[dgiambo1]

- These switches are factory default settings other than the IP and trunk mode settings for the trunk ports (16 and 23).

- We tried all modes of spanning-tree, same results

- This command only shows 1 entry for the MAC on Gi1/13 where the PC is plugged in. 

- Again, only one port shows the mac. Since there are only 2 ethernet cables in this system that makes sense, we can't create a loop.

- There are no load balancing configurations enabled, there is only 2 cables, 1 trunked to another C1000 with nothing plugged in, and 1 connected to port 13 into a PC (which we're getting flapping messages for)

[dgiambo1]

Anything else we could try? For more information - this problem goes away completely if we plug a 3rd switch into port 24 of the C1000. The C1000 is now trunked to both the 16 port and another 3650 - the flapping messages stop. It's only when 2 C1000 are trunked together that we see this issue.