Question about MLD snooping

[drc@dansknet.dk]

Hi All

I have an issue, with one of our routers a CISCO7609 running with 2 supervisors WS-SUP720-3BXL (hot) and a WS-SUP720-BASE (active)

We keep getting the following messages in the log output. I cannot seem to find any solution for this, so i hope that you guys can help me :)

Jan 2 09:49:09.260: %MCAST-SP-6-ETRACK_LIMIT_EXCEEDED: MLD snooping was trying to allocate more explicit-tracking entries than what allowed (32000)
Jan 2 09:49:09.256: %MCAST-SP-STDBY-6-ETRACK_LIMIT_EXCEEDED: MLD snooping was trying to allocate more explicit-tracking entries than what allowed (32000)

Best regards

Danny

[Peter Paluch]

Hi Danny,

The IPv6 MLD Snooping is on by default on switches that support it, similar to IGMP Snooping. MLD Snooping also builds an explicit tracking database of subscribers to support fast leave and proxy reporting:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-0SY/configuration/guide/15_0_sy_swcg/ipv6_mld_snooping.pdf

If you are using IPv6 multicast in your network and rely on MLD Snooping, you can look into tuning the size of the database for the explicit entries using the ipv6 mld snooping limit track command to increase it if possible. If you are not using IPv6 multicast, then the explicit tracking is not needed for you, and you may want to disable it; depending on your IOS version, this may be done either in the vlan configuration section, or on an SVI, using the no ipv6 mld snooping explicit-tracking command, or - somewhat of a trick - configuring the ipv6 mld snooping limit track 0 command.

Best regards,
Peter

[drc@dansknet.dk]

We don't have any IPv6 multicast in our network and i cannot disable it because the ipv6 command doesn't exist, and that's where i'm stuck because i can't seem to find any other way to disable it. But in our setup we don't have any multicast so if there is a way to disable that all together, maybe that can fix it. 

[Peter Paluch]

Hi Danny,

What exact IOS version are you running? Disabling the complete MLD Snooping should be possible using the no ipv6 mld snooping command in the global configuration mode, and this should also take care of the logging message.

Best regards,
Peter

[drc@dansknet.dk]

We are running:

#show version
Cisco IOS Software, c7600s72033_rp Software (c7600s72033_rp-IPSERVICESK9-M), Version 12.2(33)SRB, RELEASE SOFTWARE (fc6)

I've tried it, but it doesn't work unfortunately

#no ipv6 mld snooping
          ^
% Invalid input detected at '^' marker.
 

[drc@dansknet.dk]

I tried to command in the global config mode, just didnt copy config part :)
(config)#no ipv6 mld snooping
^
% Invalid input detected at '^' marker.

[Peter Paluch]

Danny,

Let me see if I can dig out a 7600 in our labs running a similar IOS version to test this.

Best regards,
Peter

[drc@dansknet.dk]

Hi Peter

Thanks alot for the help so far! 

[Peter Paluch]

Hi Danny,

Hmmm, this is starting to get interesting. I have a 12.2(33)SRC - admittedly not SRB - but the IPv6 and the MLD commands are there:

7600-1(config)#no ipv6 mld ?
  snooping  Global MLD Snooping enable for Catalyst Vlans
  ssm-map   SSM Mapping commands

7600-1(config)#no ipv6 mld snooping ?
  limit  Configure MLD Snooping limits
  <cr>

7600-1(config)#no ipv6 mld snooping 

7600-1(config)#do show ver | i bootdisk
System image file is "bootdisk:c7600rsp72043-advipservices-mz.122-33.SRC.bin"

This may still be related to the SRC vs. SRB, though. Danny, are you telling me there are no commands in your global config mode whatsoever that start with the ipv6 keyword?

I am continuing to look into this for you.

Best regards,
Peter

[drc@dansknet.dk]

Hi Peter

Just checked again, here are the commands available to me when i try "i?"

(config)#i?
identity image interface intrusion-detection ip
isis issu

(config)#no i?
identity image interface intrusion-detection ip
isis issu

There are no ipv6 commands and i've checked our config and there is no ipv6 commands entered. 

[Peter Paluch]

Danny,

Can you please share the full output of show module and show version from this switch? Feel free to remove the serial numbers / MAC addresses.

Thank you!

Best regards,
Peter

[drc@dansknet.dk]

Hi Peter

Here is the output..

#show module
Mod Ports Card Type Model Serial No.
--- ----- -------------------------------------- ------------------ -----------
1 24 CEF720 24 port 1000mb SFP WS-X6724-SFP
5 2 Supervisor Engine 720 (Hot) WS-SUP720-3BXL
6 2 Supervisor Engine 720 (Active) WS-SUP720-BASE
9 4 CEF720 4 port 10-Gigabit Ethernet WS-X6704-10GE

Mod MAC addresses Hw Fw Sw Status
--- ---------------------------------- ------ ------------ ------------ -------

Mod Sub-Module Model Hw Status
---- --------------------------- ------------------ ------- -------
1 Centralized Forwarding Card WS-F6700-CFC 2.0 Ok
5 Policy Feature Card 3 WS-F6K-PFC3BXL 1.10 Ok
5 MSFC3 Daughterboard WS-SUP720 1.4 Ok
6 Policy Feature Card 3 WS-F6K-PFC3BXL 1.8 Ok
6 MSFC3 Daughterboard WS-SUP720 2.2 Ok
9 Centralized Forwarding Card WS-F6700-CFC 2.0 Ok

Mod Online Diag Status
---- -------------------
1 Pass
5 Pass
6 Pass
9 Pass

----------------------------------------------------------------------------------------------------------

#show version
Cisco IOS Software, c7600s72033_rp Software (c7600s72033_rp-IPSERVICESK9-M), Version 12.2(33)SRB, RELEASE SOFTWARE (fc6)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2007 by Cisco Systems, Inc.
Compiled Wed 28-Feb-07 16:10 by prod_rel_team

ROM: System Bootstrap, Version 12.2(17r)SX5, RELEASE SOFTWARE (fc1)

rtr_core_boa uptime is 10 weeks, 4 days, 22 hours, 24 minutes
Uptime for this control processor is 10 weeks, 4 days, 22 hours, 23 minutes
Time since rtr_core_boa switched to active is 10 weeks, 4 days, 22 hours, 24 minutes
System returned to ROM by reload at 06:12:43 UTC Sat Dec 13 2014 (SP by reload)
System restarted at 15:12:36 CEST Fri Oct 19 2018
System image file is "disk0:c7600s72033-ipservicesk9-mz.122-33.SRB.bin"
Last reload type: Normal Reload
Last reload reason: Unknown reason

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco CISCO7609 (R7000) processor (revision 1.1) with 983008K/65536K bytes of memory.
Processor board ID FOX084403SC
SR71000 CPU at 600Mhz, Implementation 0x504, Rev 1.2, 512KB L2 Cache
Last reset from s/w reset
77 Virtual Ethernet interfaces
28 Gigabit Ethernet interfaces
4 Ten Gigabit Ethernet interfaces
1917K bytes of non-volatile configuration memory.
8192K bytes of packet buffer memory.

65536K bytes of Flash internal SIMM (Sector size 512K).
Configuration register is 0x2102

[Peter Paluch]

Hello Danny,

Sorry for falling silent yesterday. I tried to research internally, dig through existing TAC cases I have access to, but I could not find any documented case where, on a 7600 router with SUP720 running 12.2(33)SRB, MLD Snooping would be on while ipv6 commands in the global config mode would be unavailable. This is getting truly confusing.

Please let me ask you:

• Do you have any show ipv6 and show ipv6 mld commands available? If so, can you share the outputs of the show ipv6 mld snooping explicit-tracking command?
• Are you using any access control mechanism to your CLI that would limit the availability of certain commands - TACACS+, CLI views (parser view), non-default privilege levels? Can you reproduce the same behavior with a locally created user that is in the privilege level 15 and is not authorized through TACACS+?

Best regards,
Peter

[drc@dansknet.dk]

Hi Peter

I am using a local user with priv-level 15.

Here is the commands i have available. 

#show ip?
ip ipc

I have no ipv6 commands at all on the router.