cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
759
Views
0
Helpful
5
Replies
satish.txt1
Beginner

Cisco nexus loopguard question

I have cisco nexus switches in vPC and they are connected to HP c7000 blade center switches and all my c7000 blade server has Linux Bridge is running, i believe something went wrong somewhere in Linux Bridge configuration which created loop and it block trunk ports, now question is how do i find out where that loop happened and how do i recover from loopguard state?

I have multiple VLAN on switch but only VLAN 27 get stuck in loop, I have tried debug spanning-tree but i didn't see anything in debug.

If i shutdown servers do you think that will stop loop?

swt-tor2(config)# show spanning-tree vlan 27

VLAN0027
  Spanning tree enabled protocol rstp
  Root ID    Priority    8219
             Address     0023.04ee.be01
             Cost        3
             Port        5094 (port-channel999)
             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32795  (priority 32768 sys-id-ext 27)
             Address     00c8.8bbd.557c
             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Po3              Root FWD 1         128.4098 (vPC) P2p
Po11             Desg FWD 1         128.4106 (vPC) P2p
Po12             Desg FWD 1         128.4107 (vPC) P2p
Po13             Desg BKN*1         128.4108 (vPC) P2p *LOOP_Inc
Po14             Desg BKN*1         128.4109 (vPC) P2p *LOOP_Inc
Po15             Desg FWD 1         128.4110 (vPC) P2p
Po16             Desg FWD 1         128.4111 (vPC) P2p
Po21             Desg FWD 1         128.4116 (vPC) P2p
Po22             Desg FWD 1         128.4117 (vPC) P2p
Po23             Desg BKN*1         128.4118 (vPC) P2p *LOOP_Inc
Po24             Desg BKN*1         128.4119 (vPC) P2p *LOOP_Inc
Po25             Desg FWD 1         128.4120 (vPC) P2p
Po26             Desg FWD 1         128.4121 (vPC) P2p
Po31             Desg FWD 1         128.4126 (vPC) P2p
Po32             Desg FWD 1         128.4127 (vPC) P2p
Po33             Desg BKN*1         128.4128 (vPC) P2p *LOOP_Inc
Po34             Desg BKN*1         128.4129 (vPC) P2p *LOOP_Inc
Po999            Root FWD 1         128.5094 (vPC peer-link) Network P2p

Update - 1

enter image description here

We have very basic switches in bladecenter nothing fancy.

on server side i have configured bond0.27 and on top of bond0.27 i have configured bridge interface (which has STP off)

# Openstack Octivia Managment Interface
DEVICE=br-lbaas
NAME=br-lbaas
BOOTPROTO=static
ONPARENT=yes
TYPE=Bridge
ONBOOT=yes
NM_CONTROLLED=no
DELAY=0
STP=no
IPADDR=172.27.8.21
NETMASK=255.255.248.0
ETHTOOL_OPTS="-K ${DEVICE} gso off sg off tso off tx off" 

Directly connected bladecenter switch ports are loop-BLK* currently and we have many VLAN only VLAN 27 specific in loop-BLK*, other VLAN traffic flowing normal

This is port configuration connected to blade switches ( Port-Channel13 is currently in loop protection mode which you can see above)

interface port-channel13
  description "connected to blade" 
  switchport mode trunk
  switchport trunk allowed vlan 10-12,20-22,27-32,40,50,100,200
  speed 10000
  vpc 13

I believe when i configured some openstack neutron networking that time something happened, i don't know where that BPDU comes, I don't think Linux server sending any BPDU in this scenario.

Do you think i should remove VLAN 27 from all switches and reconfigure?

Update -2

Here is the output of spanning-tree https://pastebin.com/F7mGdzEX

Here is the log output which you requested.

swt-tor1-010101-1-3-hd# show logg | include LOOP
2019 Jun 28 10:34:30 swt-tor1-010101-1-3-hd %STP-2-LOOPGUARD_BLOCK: Loop guard blocking port port-channel13 on VLAN0027.
2019 Jun 28 10:44:16 swt-tor1-010101-1-3-hd %STP-2-LOOPGUARD_BLOCK: Loop guard blocking port port-channel23 on VLAN0027.
2019 Jun 28 10:48:13 swt-tor1-010101-1-3-hd %STP-2-LOOPGUARD_BLOCK: Loop guard blocking port port-channel33 on VLAN0027.
2019 Jun 30 22:23:29 swt-tor1-010101-1-3-hd %STP-2-LOOPGUARD_BLOCK: Loop guard blocking port port-channel34 on VLAN0027.
2019 Jul  2 22:25:34 swt-tor1-010101-1-3-hd %STP-2-LOOPGUARD_BLOCK: Loop guard blocking port port-channel24 on VLAN0027.
2019 Jul  2 22:26:36 swt-tor1-010101-1-3-hd %STP-2-LOOPGUARD_BLOCK: Loop guard blocking port port-channel14 on VLAN0027.

Here is the HP 6120XG switch spanning-tree output: https://pastebin.com/LE05x68P

5 REPLIES 5
Mark Malone
VIP Mentor

Hi
see if you can see where the loop is occurring with this command , it may narrow down where the STP state changes are occurring from

show spanning-tree detail | inc ieee|occurr|from

If you look at my command output "show spanning-tree vlan 27" loop happened in multiple ports and they all connected to different c7000 blade center, I believe this is happened because i have something mis-configured on openstack neutron which did something, i have no idea what happened and how did it generated 2 BPDU which put that port in loopgurad  ( I am still scratching my dead how did HP6120XG send 2 BPDU and where they came from because they shouldn't send BPDU anyway because they are last switch in network) 

 

I am considering configure BPDU-Filter on Nexus switch port connected to HP switches, Do you think that should be fine because HP switch is last switch and it has no LOOP to any other switch.  

 

 

i wouldnt turn off STP could get worse ,if these are a and b servers i would try turn off the side thats in standby just leave the active side running

Just wondering if that HP6120XG switch is just acting like port expanders (ack like HUB) in that case what could go wrong to disable STP?  

I dont know these blades i dont use them we have 3020s dell in chassis in VPC mode back to 5ks but when i check google it says they understand STP so turning it off could be an issue

https://h20195.www2.hpe.com/v2/getpdf.aspx/c04140206.pdf?ver=11