Network Unkown Issue

[FerasAlqawlaq02499]

Hi Guys ,

I have tow Core Cisco 4500x switches and there is a vss between them. also , i have an access switch connect to Core switch via ether channel from both sides. also, i create a MGMT vlan in the both switches to can manage them via telent connection. the access switch has interface vlan 20 with IP address 10.0.0.20/24 and ip default-gateway 10.0.0.1 to the core switch. regarding the issue , sometimes i can not ping from PC to the access switch. but sometimes it works. while i was checking the issues , i found that if i ping from core to access it will works from PC. please need any idea about this issue.

[Georg Pauwen · Accepted solution]

Hello,

what is the IP address of the PC, and where is the default gateway for the PC configured ?

[FerasAlqawlaq02499]

The IP address of PC is 10.65.99.200 with default gateway 10.65.99.1 (user vlan). I can ping from PC to MGMT & User VLAN gateway. 

[FerasAlqawlaq02499]

Also , all the VLAN's gateway are in core switch , there is routing between them 

[Georg Pauwen]

Hello,

can you post the configuration of the access switch you are trying to ping ? Which model is that (e.g. 2960)?

[FerasAlqawlaq02499]

Hi Georg ,

the access switch model is WS-C2960X-48FPD-L. also , i have uploaded the access switch configurations.

[vb10]

Hello,

Can you clarify several questions:

1. What is the software version on your 4500 VSS switches?

2. What is the mac of Vlan20 interface on access switch? (show int vlan 20)

3. Can you collect at the time, when ping doesn't work from PC following outputs:

- show platform software floodset vlan 20
- show platform hardware floodset vlan 20

- show mac address-table vlan 20

[FerasAlqawlaq02499]

Hi ,

Would like to output the below commands on core or access switch ?

- show platform software floodset vlan 20
- show platform hardware floodset vlan 20

- show mac address-table vlan 20

thanks  a lot

[vb10]

On core switch. As I understood, routing between mgmt and PC vlans is done on core switch, right?

[FerasAlqawlaq02499]

yes , the routing between VLAN's on core switch. regarding show platform commands , i'm afraid to use these commands to avoid any hang. as i read some of 4500x troubleshoot commands , the document is telling us that (debug + show platform ) is used only from Cisco TAC team. what do you recommend ?. i don't have a lot of knowledge in this depth-troubleshoot.

[vb10]

I don't expect that these 2 commands can cause any issues. I have executed them multiple times in the past and can't recall any hangs, or other problems. But final decision is, of course, up to you. With these commands I wanted to verify unknown unicast floodsets. Because there is one bug on 4500 switches, related to flooding, with similar symptoms as you described. 

Also, please send SW version, which you have on your 4500 switches

[FerasAlqawlaq02499]

Hi Friend ,

Thanks a lot for this kindness support , please find the attachment as requested

[vb10]

Hello,

Thanks for outputs. Were they collected during the time, when problem existed (ping didn't work)? Or when ping was working?

From what I see, 4500 switch really seems to be affected by the bug CSCvb78700:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvb78700/

Hardware unicast floodset for vlan 20 is empty:

 GNP-CORE-4500X#show platform hardware  floodset vlan 20
Executing the command on VSS member switch role = VSS Active, id = 1
Vlan 20:
Unicast Floodset:
FloodToCpu: -
RetIndex: 20

In normal scenario, it should contain the same list of ports, as software floodset:

GNP-CORE-4500X#show platform software floodset vlan 20
Executing the command on VSS member switch role = VSS Active, id = 1
Vlan 20:
Unicast Floodset:
Vlan 20: Po11  Po12  Po13  Po14  Po16  Po17  Po18  Po19  Po20  Po22  Po23  Po24

Because of this bug, switch doesn't send unknown unicast (when destination MAC is not known) traffic in hardware via required ports, when you ping from PC. When you ping from switch itself, it uses software floodset, which has required ports, and learns MAC from returning traffic. After that ping from PC also starts to work, because traffic is sent, based on MAC address table, not floodset.

But again, this bug has impact only, when destination MAC address is not known by the switch. In your case, I see, that access switch mac is learnt by core switch. 

  20      5008.aca7.2ac1   dynamic ip,ipx,assigned,other Port-channel22

So, were these commands corrected during working, or non-working conditions?

[FerasAlqawlaq02499]

Hi friend ,

Thanks a lot for this high support. Appreciate your working to find the best solution for this. When I use the below commands in the core switch, the user wasn't able to ping the access switch.

show platform hardware  floodset vlan 20

show platform software floodset vlan 20

Show mac address-table vlan 20 

So , what solution can i use to solve this bug CSCvb78700

[vb10]

In order to fix that bug, you can consider to upgrade the core switch.

But again, this bug has impact when destination MAC address (MAC of access switch in your case) is not known. But in your case MAC of access switch is known. If you are sure, that outputs we collected during the time, when ping didn't work, then it might be other issue, which requires more deep troubleshooting. Then it will be probably better to work with Cisco TAC.