NEAT authenticated Trunk port does not participate in STP

h.thiele · ‎01-02-2015

Hi everbody,

I observed the following problem with an NEAT authenticated Trunk Port:

Test Setup:

Catalyst 4506-E ( 03.07.00E )

Gig4/1

|

Gig0/10

Catalyst 2960C ( 15.2(2)E )

Port Config 4506-E

interface GigabitEthernet4/1
description *** uplink 2960C Gig0/10 ***
switchport trunk native vlan 10
switchport trunk allowed vlan 10
switchport mode trunk
no logging event link-status
duplex full
authentication control-direction in
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate 10800
authentication timer inactivity 330
authentication violation replace
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
storm-control broadcast level 20.00
spanning-tree portfast trunk
ip dhcp snooping trust

Port Config 2690C

interface GigabitEthernet0/10
description uplink 4506-E Gig4/1
switchport trunk native vlan 10
switchport trunk allowed vlan 10
switchport mode trunk
media-type rj45
duplex full
dot1x pae supplicant
dot1x credentials neat
dot1x supplicant eap profile fast
spanning-tree bpduguard disable
ip dhcp snooping limit rate 100
ip dhcp snooping trust

The Port is authenticated:

4506-E#sho authentication sessions

Interface MAC Address Method Domain Status Fg Session ID
Gi4/1 f41f.c22b.XXXX dot1x DATA Auth AC1179DF0000131E439B64BC

The Switchport looks god so far:

4506-E#sho int g4/1 swi
Name: Gi4/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 10 (UserSegment)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings: none
Operational private-vlan: none
Trunking VLANs Enabled: 10
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

But the Trunk Port does not show the VLAN 10 in STP Forwarding:

wgs-wlc-sp02#sho int trunk

Port        Mode             Encapsulation Status        Native vlan
Te1/8       on               802.1q         trunking      10
Gi4/1       on               802.1q         trunking      10

Port        Vlans allowed on trunk
Te1/8       10,122-124
Gi4/1       10

Port        Vlans allowed and active in management domain
Te1/8       10
Gi4/1       10

Port        Vlans in spanning tree forwarding state and not pruned
Te1/8       10
Gi4/1       none

The STP State shows nothing for VLAN 10:

wgs-wlc-sp02#sho spanning-tree vlan 10

VLAN0010
Spanning tree enabled protocol rstp
Root ID    Priority    12298
             Address     001d.a23a.XXXX
             Cost        4
             Port        8 (TenGigabitEthernet1/8)
             Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority    32778 (priority 32768 sys-id-ext 10)
             Address     7c0e.ce9d.XXXX
             Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec
             Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Te1/8 Root FWD 4 128.8 P2p

Does anybody is seeing the same Problem in the past ? I only found these bug ( CSCug43110 ) which sounds a little bit like the same.

I also seeing the problem when I replace the 4506-E with an 3850 running 03.03.05.SE code.

BR,

Holger

Peter Paluch · ‎01-02-2015

Hi Holger,

I do not have first hand experience with NEAT and a setup similar to your but these are my questions and suggestions:

On the 4506 Gi4/1, you are using spanning-tree portfast trunk command. I strongly suggest removing it. Using it between switches is always asking for trouble, and in addition, I see you are running RSTP that has its own mechanisms (namely, Proposal/Agreement) to put a link to the forwarding state rapidly. The PortFast on this port is both useless and dangerous, and should have never been put there in the first place.
What do the show span int gi4/1 and show span int gi4/1 detail commands say about the port? Can you post their output here?
What does the show span inconsistent command say? Can you post the output?

Thank you!

Best regards,
Peter

h.thiele · ‎01-08-2015

Hi Peter,

1. The spanning-tree portfast trunk command is setting by the ACS VSAs ( vendor-specific attributes -> device-traffic-class=switch ) with some other commands:

Applying command... 'no spanning-tree bpduguard enable ' at Gi4/1
Applying command... 'no switchport access vlan 10' at Gi4/1
Applying command... 'no switchport nonegotiate' at Gi4/1
Applying command... 'switchport mode trunk' at Gi4/1
Applying command... 'switchport trunk native vlan 10' at Gi4/1
Applying command... 'spanning-tree portfast trunk' at Gi4/1

If I remove the spanning-tree portfast trunk command by hand it will be overwritten during the next reauthenticate cycle.

2. and 3.

4506-E#show authentication sessions

Interface    MAC Address    Method Domain Status Fg Session ID
Gi5/47       0022.bd1b.b22a dot1x   DATA    Auth      AC1179DF0000104A0105F1E8
Gi4/1        f41f.c22b.770a dot1x   DATA    Auth      AC1179DF000018397139BD18

Session count = 2

Key to Session Events Blocked Status Flags:

A - Applying Policy (multi-line status for details)
D - Awaiting Deletion
F - Final Removal in progress
I - Awaiting IIF ID allocation
N - Waiting for AAA to come up
P - Pushed Session
R - Removing User Profile (multi-line status for details)
U - Applying User Profile (multi-line status for details)
X - Unknown Blocker
4506-E#show span int gi4/1
no spanning tree info available for GigabitEthernet4/1

4506-E#show span int gi4/1 detail
no spanning tree info available for GigabitEthernet4/1

4506-E#show span inconsistent

Name                 Interface                Inconsistency
-------------------- ------------------------ ------------------

Number of inconsistent ports (segments) in the system : 0

Regards,

Holger

Peter Paluch · ‎01-15-2015

Hi Holger,

I apologize for the late response.

I must admit that at this point, I am confused as to what should be the next step. The STP should not be deactivated on the port - there is simply no reason for that as far as I can tell. It would perhaps be interesting to experiment with the ACS and not send any VSAs to the port, limiting oneself purely to the authentication without sending down any attributes. But beyond that, I am not sure what else should be tried - apart from contacting Cisco TAC, of course.

I am sorry I cannot help further.

Best regards,
Peter