Hello James,
Hopefully, you have found your answer by now, but recently I came across similar issue when replacing older ISR router with ISR4321, which did not support BVI feature.
This is an example of configuration, in which I encountered the issue:
+-----------+
Gi0/0/0| ISR4321 |Gi0/0/1
+---------+ +--------+
| +-----------+ |
| BDI100 |
| |
| |
| |
Fa0/2 | |Fa0/3 <- access ports.
+--------+Fa0/1 Fa0/1+--------+
|CAT2960S+-------------------------+CAT2960S|
+--------+ TRUNK +--------+
I had to work the BDI configuration in such a way that two switches connected to ISR4321 would form two redundant paths. However, with a configuration in which two switch ports are configured as access ports, I noticed that router is not taking part in STP process at all, which caused MAC flaps. The Mac address associated with flaps was related to BDI interface MAC address.
And I believe, it is expected because router has no idea to what VLAN does a certain frame belong to as switches do not add a dot1q tag to frames sent through the access ports. Because of this, router did not know how to participate in STP process and both of the physical-interfaces were forwarding:
ISR4321(config)#do sh spa
Bridge group 100
Spanning tree enabled protocol vlan-bridge
Root ID Priority 32768
Address 6412.25a2.f450
This bridge is the root
Hello Time 2 sec Max Age 30 sec Forward Delay 20 sec
Bridge ID Priority 32768
Address 6412.25a2.f450
Hello Time 2 sec Max Age 30 sec Forward Delay 20 sec
Aging Time 300
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
This in turn, caused the mentioned MAC flaps both on the access and trunk ports on the switches. Router will by default send the frames for a specific flow which is reachable on BDI interface through two physical interfaces, thus, which causes a MAC flaps. For example:
2960-2#
*Mar 1 07:02:09.375: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/1 and port Fa0/3
*Mar 1 07:02:25.381: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/3 and port Fa0/1
*Mar 1 07:02:40.464: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/1 and port Fa0/3
*Mar 1 07:02:53.399: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/1 and port Fa0/3
*Mar 1 07:03:09.396: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/3 and port Fa0/1
*Mar 1 07:03:27.381: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/1 and port Fa0/3
*Mar 1 07:03:39.402: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/1 and port Fa0/3
*Mar 1 07:03:55.399: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/1 and port Fa0/3
*Mar 1 07:04:09.408: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/3 and port Fa0/1
*Mar 1 07:04:31.403: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/3 and port Fa0/1
*Mar 1 07:04:41.411: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/3 and port Fa0/1
*Mar 1 07:04:57.408: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/1 and port Fa0/3
*Mar 1 07:05:09.395: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/1 and port Fa0/3
*Mar 1 07:05:23.404: %SW_MATM-4-MACFLAP_NOTIF: Host 6412.25a2.f4d3 in vlan 100 is flapping between port Fa0/3 and port Fa0/1
2960-2#
I found that the best configuration which allows for redundancy and eliminates L2 loops is one, that will make sure router receives frames with dot1q tag, as follows:
1. First of all, switches should have their links connected to the router configured as trunks, on which we allow specific VLANs. In my case, it was one VLAN.
2. On the router, configure a Bridge Domain, and a Service Instance under specific interfaces and make sure, that encapsulated traffic is matched by Service Instance where we are popping one tag, for example, for VLAN 100:
!
interface GigabitEthernet0/0/0
bandwidth 100000
no ip address
negotiation auto
service instance 100 ethernet
encapsulation dot1q 100
rewrite ingress tag pop 1 symmetric
l2protocol peer stp
bridge-domain 100
!
3. Lastly, make sure that STP is enabled on Router:
ISR4321#conf t
Enter configuration commands, one per line. End with CNTL/Z.
ISR4321 (config)#spanning-tree mode rapid-pvst
ISR4321 (config)#end
When all of this is configured right, we see that one of the Router's interfaces goes into blocking state due to STP and that prevents an L2 loop:
ISR4321#sh spanning-tree vlan 100
G1:VLAN0100
Spanning tree enabled protocol rstp
Root ID Priority 24676
Address 001f.274f.f180
Cost 19
Port 9 (GigabitEthernet0/0/1)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32868 (priority 32768 sys-id-ext 100)
Address 6412.25a2.f4d2
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 0
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/0/0 Altn BLK 19 128.8 P2p
Gi0/0/1 Root FWD 19 128.9 P2p
Also, it ensures we have redundancy of course.
Hope this helps,
Roman
