Re: Host is flapping and BPDU Guard is doing its job

Wassim Aouadi · ‎09-23-2010

I have a switch port that's constantly being shut by BPDU Guard:

TNSWACCS03A3(config-if)#do sh int statu err

Port Name Status Reason Err-disabled Vlans
Fa1/0/16 Ben Rhouma Ramzi err-disabled bpduguard

------------------------------------

TNSWACCS03A3(config-if)#shut
TNSWACCS03A3(config-if)#no
Sep 23 13:31:24.231 UTC: %ILPOWER-5-POWER_GRANTED: Interface Fa1/0/16: Power granted
TNSWACCS03A3(config-if)#no shut
TNSWACCS03A3(config-if)#
Sep 23 13:31:27.092 UTC: %LINK-3-UPDOWN: Interface FastEthernet1/0/16, changed state to up
Sep 23 13:31:28.099 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/16, changed state to up
Sep 23 13:31:28.141 UTC: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Fa1/0/16 with BPDU Guard enabled. Disabling port.
Sep 23 13:31:28.141 UTC: %PM-4-ERR_DISABLE: bpduguard error detected on Fa1/0/16, putting Fa1/0/16 in err-disable state
TNSWACCS03A3(config-if)#

I tried to disable BPDU Guard and enable BPDU Filter to see what happens:

TNSWACCS03A3(config)#
TNSWACCS03A3(config)#int fa1/0/16
TNSWACCS03A3(config-if)#spanning-tree bpdufilter enable
TNSWACCS03A3(config-if)#
TNSWACCS03A3(config-if)#spanning-tree bpduguard disable
TNSWACCS03A3(config-if)#
TNSWACCS03A3(config-if)#
TNSWACCS03A3(config-if)#

and here's what I get:

Sep 23 13:36:17.717 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 9caf.cafe.7c33 in vlan 2222 is flapping between port Fa1/0/16 and port Po1
Sep 23 13:36:17.717 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 9caf.caff.5f65 in vlan 2222 is flapping between port Fa1/0/16 and port Po1
TNSWACCS03A3(config-if)#
Sep 23 13:36:23.715 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 18a9.0589.6701 in vlan 14 is flapping between port Fa1/0/16 and port Fa1/0/26
TNSWACCS03A3(config-if)#
Sep 23 13:36:26.902 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 0026.55ca.68eb in vlan 14 is flapping between port Fa1/0/16 and port Fa1/0/22
TNSWACCS03A3(config-if)#
Sep 23 13:36:32.288 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 9caf.caff.5ac6 in vlan 2222 is flapping between port Fa1/0/16 and port Po1
Sep 23 13:36:33.261 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 9caf.caff.56de in vlan 2222 is flapping between port Fa1/0/16 and port Po1
TNSWACCS03A3(config-if)#
Sep 23 13:36:37.606 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 0022.64c0.2623 in vlan 14 is flapping between port Fa1/0/16 and port Fa1/0/24
TNSWACCS03A3(config-if)#
Sep 23 13:36:39.821 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 0026.5537.707f in vlan 14 is flapping between port Fa1/0/16 and port Fa1/0/18
TNSWACCS03A3(config-if)#
Sep 23 13:36:50.793 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 9caf.caff.5ac6 in vlan 2222 is flapping between port Fa1/0/16 and port Po1
Sep 23 13:36:50.793 UTC: %SW_MATM-4-MACFLAP_NOTIF: Host 9caf.caff.56de in vlan 2222 is flapping between port Fa1/0/16 and port Po1

This is the port config:

TNSWACCS03A3#sh run int fa1/0/16
Building configuration...

Current configuration : 275 bytes
!
interface FastEthernet1/0/16
description Ben Rhouma Ramzi
switchport access vlan 14
switchport mode access
switchport voice vlan 2222
priority-queue out
mls qos trust cos
spanning-tree portfast
spanning-tree bpdufilter disable
spanning-tree bpduguard enable
end

any idea?

krahmani323 · ‎09-23-2010

Hello Wass,

As per the logs I can see the interface Fa1/0/16 is changing to err-disable due to bpdu-guard fonctionality. It means the interface has received a spanning-tree BPDU although it should not per the interface config.

According to the interface configuration and logs provided I think that it is likely a L2 loop created buy an incorrect cabling.

Can you check physically or ask someone to do it in order to see where the cable from Fa1/0/16 is connected to ?

If it is going to Ben Rhouma Ramzi's phone, on what port phone is it connected (Sw or PC) ?

Then where the other phone port is going to ? Has it been cabled to another RJ45 wall jack ? Or maybe to a Hub itself connected to another wall jack ?

It is very possible a L2 loop has been made due to the logs when you enabled bpdufilter.

First advice : Do not enable bpdufilter (deactivation of spanning-tree on the interface) as this function is to use under very controlled circumstances when we are sure about what type device is connected. It is not the case in our scenario as we can see it with host flapping in consequence.

Re-activate bpdu-guard and CHECK PHYSICALLY and fix the cabling.

Thanks nd regards.

Karim

Wassim Aouadi · ‎09-24-2010

the wall jack is connected to a cisco ip phone, to which a PC is connected (Ramzi). So there's no switch-to-switch in here. I activated BPDU filter since I was sure that the end host is not a switch. Besides, cabling is correct.

Arup Dutta · ‎09-24-2010

Hi Wass,

i am faceing the same problem and some time my VLAN 4 goes down and after some time it goes up.

please help me if you find the actual reason.

Thank you,

Arup

milan.kulik · ‎09-25-2010

Hi,

which Cisco IP phone model?

IMHO, it has a built-in switch when connecting a PC.

BR,

Milan

milan.kulik · ‎09-25-2010

Hi,

which Cisco IP phone model?

IMHO, it has a built-in switch when connecting a PC.

BR,

Milan