Question related to spanning-tree etherchannel guard misconfig

[tony-maheu]

Hi,

I'm looking for many days some informations about the compatibilty over spanning-tree etherchannel guard misconfig and the new I.O.S 15.0.2 SE.

This command : spanning-tree etherchannel guard misconfig, was enable before upgrade IOS in running-config

Switch ws-c2960-24S-TS-S older IOS c2960s-universalK9-m 12.2(53)SE.     --> c2960s-universalk9-mz150-2SE

Switch ws-c3560X-24 older IOS c3560e-universalK9-m 12.2(55).                  --> c3560e-ipbasek9-mz150-2SE

Switch ws-c3560G-24-TS older IOS c3560e-universalK9-m 12.2(44)SE6.      --> c3560e-ipbasek9-mz150-2SE

Switch ws-c2960s-48-TC-L older IOS c2960s-lanliteK9 12.2(25)FX.              --> c2960s-universalk9-mz150-2SE

I did some tests:

     - In "conf t" write : "spanning-tree etherchannel guard misconfig" --> not enable.

     - I reset my 2 physicals ports and etherchannel ports then reconfigured --> not enable

      - I configure at the level physic port the "spanning-tree etherchannel guard misconfig" --> not enable

I can't find any explications for this point. This command is it implemented in I.O.S? if yes, how to see it?

Please, could you bring me a answer  ? :-)

[Arumugam Muthaiah]

Hi Tony,

I can see that Catalyst 3560, 3750 with IOS Release 15.0(2)SE support this command.

Use the spanning-tree etherchannel guard misconfig global configuration command to display an error message when the switch detects an EtherChannel misconfiguration. Use the no form of this command to disable the feature.

Switch(config)# spanning-tree etherchannel guard misconfig

Switch(config)# no spanning-tree etherchannel guard misconfig

When the switch detects an EtherChannel misconfiguration, this error message appears:

PM-4-ERR_DISABLE: Channel-misconfig error detected on [chars], putting [chars] in err-disable state.

When a port is in the error-disabled state because of an EtherChannel misconfiguration, you can bring it out of this state by entering the errdisable recovery cause channel-misconfig global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands

Refer:

Catalyst 3560 Switch Software Configuration Guide, Cisco IOS Release 15.0(2)SE

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/15.0_2_se/configuration/guide/swstpopt.html

Catalyst 3560 Switch Command Reference, Cisco IOS Release 15.0(2)SE

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/15.0_2_se/command/reference/cli3.html#wp1945681

Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/15.0_2_se/configuration/guide/swstpopt.pdf

Regards,

Aru

*** Please rate if the post is helpful ***

[tony-maheu]

Hi Aru,

Thank you for this introduction about spanning tree etherchannel guard misconfig + annex.

I've tried another tests :

    1) Switch(config)# no spanning-tree etherchannel guard misconfig

     2) Switch(config)# spanning-tree etherchannel guard misconfig => nothing in my running-config or startup-config (not write)

     3) Switch(config)#errdisable recovery cause channel-misconfig => enable on my running-config (write)

You can see an extract of running-config after i have done the 1st,the 2nd and 3rd test :

spanning-tree mode rapid-pvst

spanning-tree logging

spanning-tree portfast bpduguard default

spanning-tree extend system-id

!

!

!

errdisable recovery cause channel-misconfig (STP)

!

Have you got an idea about this command and why isn't enable in my running-config?

Regards

[Arumugam Muthaiah · Accepted solution]

Hi Tony,

Sorry for the late response. I tried check on my lab and found below detail,

Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#spanning-tree etherchannel guard misconfig
Switch(config)#
Switch(config)#exit
Switch#

Switch#show spanning-tree summary
Switch is in pvst mode
Root bridge for: VLAN0022, VLAN0088, VLAN0160, VLAN0300, VLAN0400, VLAN0408
  VLAN0463, VLAN0500, VLAN0593, VLAN0861, VLAN1000-VLAN1001
EtherChannel misconfig guard is enabled
Extended system ID           is enabled
Portfast Default             is disabled
PortFast BPDU Guard Default  is disabled
Portfast BPDU Filter Default is disabled
Loopguard Default            is disabled
UplinkFast                   is disabled
BackboneFast                 is disabled
Pathcost method used         is short

After disable the command,

Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#no spanning-tree etherchannel guard misconfig
Switch(config)#
Switch(config)#
Switch(config)#exit

Switch#show spanning-tree summary         
Switch is in pvst mode
Root bridge for: VLAN0022, VLAN0088, VLAN0160, VLAN0300, VLAN0400, VLAN0408
  VLAN0463, VLAN0500, VLAN0593, VLAN0861, VLAN1000-VLAN1001
EtherChannel misconfig guard is disabled
Extended system ID           is enabled
Portfast Default             is disabled
PortFast BPDU Guard Default  is disabled
Portfast BPDU Filter Default is disabled
Loopguard Default            is disabled
UplinkFast                   is disabled
BackboneFast                 is disabled
Pathcost method used         is short

Switch#sh run

Building configuration...

spanning-tree mode pvst
no spanning-tree etherchannel guard misconfig
spanning-tree extend system-id

• I found that when i enable this command, it was not visible in running config
  
• But when i check the #show spanning-tree summary, i can see that the EtherChannel misconfig guard is enabled
  
• When i disable the command, i can see that it is disabled and at the same time, running-config showing as no spanning-tree etherchannel guard misconfig
  
  

So it will be enable once you execute this command and save the config on the switch.

Regards,

Aru

*** Please rate if this post is useful ***

[tony-maheu]

Hello,

i'm sorry, i couldn't thank you more early ...

It's strange but it's ok it's an antoher manner to checher...

In fact, there are four cases where commands aren't displayed in the run config

- etherchannel now is ok

- the radius config ->the command chain is different if i understood

- ipsubzero

- ntp clock-server

have you got any idea for 3 cases last?

[Giuseppe Larosa]

Hello Tony,

in Cisco IOS if you enter a command that is already enabled by default the command is not shown in the output of show running-config.

The tests performed by Arumugam show that in recent IOS versions the command spanning-tree etherchannel guard misconfig

is enabled by default and as a result of this it is not shown in the output of the show running-config.

The other cases that you mention are probably other cases of commands that are actually default settings.

Hope to help

Giuseppe

[tony-maheu]

Hello,

Thank you Giuseppe for you answer.

My problem is how check in this new I.O.S these differents points if is enable or disable? and if disable how put it enable ?

Because my running config has changed

Thank you for you help

[Giuseppe Larosa]

Hello Tony,

>> Because my running config has changed

After IOS upgrade I guess.

There is not unfortunately a single answer, for each command you have to find an appropriate show command that demonstrates the behaviour.

ip subnet-zero is clearly a default now and no need to check this.

The radius configuration may have been moved to the use of radius-groups in a newer IOS, but this is not a real change.

show ntp status

show ntp association detail

to check NTP

Hope to help

Giuseppe

[frfi]

Late to the party, but "show run all" shows the full configuration including default settings in the configuration

IOU5#
IOU5#
IOU5#show run all | sec etherchannel
spanning-tree etherchannel guard misconfig
IOU5#

HTH
/Frederik