Strange Issue on c9200L stack

[Support ACME]

Dear ALL,

We are using the 2 x C9200L-24T-4X(17.12.05)  as stackble L3 core switch(Hold all subnet gateway) and has  4 x C2960 switch as access layer switch(using ether-channel connece to c9200L), the spanning-tree mode is rapid-pvst. We found our network will randomly disconnect around 1-2 min in specify VLAN, then I had setup the server in outside  and using "pinginfoview" software to monitor the  VLANIP under C9200 , I sure this issue only happen in specify VLAN, i have no idea to solve this problem, anyone can help?

[MHM Cisco World]

Can you more elaborate 

You can not ping GW from server?

MHM

[Support ACME]

yes

[MHM Cisco World]

In core SW which config with vlan svi' the vlan is only allow in trunk (trunk toward access SW) ?

If yes' then check if vlan allow abd forward in # show interface trunk 

L3 svi is UP only if 

It allow abd forward in trunk 

It config with l2 port 

MHM

[Enes Simnica]

hello @Support ACME If ur network randomly drops connections in a specific VLAN for 1–2 minutes, this often points to STP instability or a possible EtherChannel misconfiguration between ur access switches and the C9200L core stack...

• u should check the : STP Root: Make sure one of the C9200Ls is the root bridge for the affected VLAN use the sh spann vlan ... command..
• Port roles - Verify no unexpected blocked or flapping ports in the VLAN path.
• AND eTHErchannel config; ensure LACP or static configs match on both ends,,

and if u can please share the output of sh spann vlan ... and show inter trunk, so we can dive deeper. and check these links: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146.html

• https://www.cisco.com/c/dam/en/us/td/docs/switches/lan/catalyst9600/software/release/16-12/configuration_guide/lyr2/configuring_etherchannels.html 

hope it helps and ping me if u have more qeustions......

-Enes

[Support ACME]

• u should check the : STP Root: Make sure one of the C9200Ls is the root bridge for the affected VLAN use the sh spann vlan ... command..

i'm sure the disconnected VLAN or normal VLAN root bridge on the C9200L .

• Port roles - Verify no unexpected blocked or flapping ports in the VLAN path.

i used "show spanning-tree inconsistentports" , no any error.

AND eTHErchannel config; ensure LACP or static configs match on both ends,

below is the one of port channel setting, interface Port-channel7
switchport trunk allowed vlan 2,23,705
switchport mode trunk

[M02@rt37]

Hello @Support ACME 

You need to check both the STP configuration and whether topology changes are occurring, especialy in the VLAN that's experiencing the issue...

If you see frequent changes or blocked ports, it likely explains the 1–2 minute disconnection.

[Support ACME]

noted, how to change it? or how to log the port status to log server?

[Support ACME]

here is the show inter tunk

Port Mode Encapsulation Status Native vlan
Gi1/0/14 on 802.1q trunking 1
Gi1/0/15 on 802.1q trunking 1
Gi1/0/17 on 802.1q trunking 1
Gi1/0/18 on 802.1q trunking 1
Gi1/0/21 on 802.1q trunking 1
Po4 on 802.1q trunking 1
Po5 on 802.1q trunking 1
Po6 on 802.1q trunking 1
Po7 on 802.1q trunking 1
Po8 on 802.1q trunking 1

Port Vlans allowed on trunk
Gi1/0/14 3000,4000-4010
Gi1/0/15 3000,4000-4010
Gi1/0/17 300,400-410
Gi1/0/18 3000,4000-4010
Gi1/0/21 3,300,400,700-710
Po4 2-3,100,300,700-701,703-705
Po5 200-204,701-702
Po6 204
Po7 2,23,705
Po8 2,23,705

Port Vlans allowed and active in management domain
Gi1/0/14 3000,4000-4004
Gi1/0/15 3000,4000-4004
Gi1/0/17 300,400
Gi1/0/18 3000,4000-4004
Gi1/0/21 3,300,400,700-705
Po4 2-3,100,300,700-701,703-705
Po5 200-204,701-702
Po6 204
Po7 2,23,705
Po8 2,23,705

Port Vlans in spanning tree forwarding state and not pruned
Gi1/0/14 3000,4000-4004
Gi1/0/15 3000,4000-4004
Gi1/0/17 300,400
Gi1/0/18 3000,4000-4004
Gi1/0/21 3,300,400,700-705
Po4 2-3,100,300,700-701,703-705
Po5 200-204,701-702
Po6 204
Po7 2,23,705
Po8 2,23,705

The affetced vlan is 2,23

[MHM Cisco World]

Are you use any L2 secuirty in access SW like 802.1x or mab ?

Use 

Monitor capture CAP interface vlan 2 both

Monitor capture CAP start 

Monitor capture CAP stop 

Show monitor capture CAP buffer breif 

Check if 9200 SVI l3 interface receive any packet when host have issue

MHM

[Support ACME]

Are you use any L2 secuirty in access SW like 802.1x or mab ?

NO

Monitor capture CAP start
Filter not attached to capture
Bytes dropped in asic - 0

Unable to activate Capture.

Check if 9200 SVI l3 interface receive any packet when host have issue

i checked the MRTG, no any traffic.

[MHM Cisco World]

Check mac address of GW in host is it same as vlan SVI Mac?

MHM

[Support ACME]

i checked the spanning-tree detail, the last change in 5d ago, our network is  disconnect 3-4 times every day.

VLAN0002 is executing the rstp compatible Spanning Tree protocol
Number of topology changes 16 last change occurred 5d13h ago
from Port-channel7
VLAN0023 is executing the rstp compatible Spanning Tree protocol
Number of topology changes 12 last change occurred 5d13h ago
from Port-channel7

[Enes Simnica]

@Support ACMEAs I already mentioned in my post, those are the usual suspects with that kind of topology

----------------------------------------------------------

from my post

hello @Support ACME If ur network randomly drops connections in a specific VLAN for 1–2 minutes, this often points to STP instability or a possible EtherChannel misconfiguration between ur access switches and the C9200L core stack...

• u should check the : STP Root: Make sure one of the C9200Ls is the root bridge for the affected VLAN use the sh spann vlan ... command..
• Port roles - Verify no unexpected blocked or flapping ports in the VLAN path.
• AND eTHErchannel config; ensure LACP or static configs match on both ends,,

and if u can please share the output of sh spann vlan ... and show inter trunk, so we can dive deeper. and check these links: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146.html

• https://www.cisco.com/c/dam/en/us/td/docs/switches/lan/catalyst9600/software/release/16-12/configuration_guide/lyr2/configuring_etherchannels.html 

hope it helps and ping me if u have more qeustions......

-Enes

[Support ACME]

VLAN0002
Spanning tree enabled protocol rstp
Root ID Priority 24578
Address 24d5.e4f5.1c00
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 24578 (priority 24576 sys-id-ext 2)
Address 24d5.e4f5.1c00
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Po3 Desg FWD 10000 128.2283 P2p
Po4 Desg FWD 10000 128.2284 P2p
Po7 Desg FWD 10000 128.2287 P2p
Po8 Desg FWD 10000 128.2288 P2p

show spanning-tree vlan 23

VLAN0023
Spanning tree enabled protocol rstp
Root ID Priority 24599
Address 24d5.e4f5.1c00
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 24599 (priority 24576 sys-id-ext 23)
Address 24d5.e4f5.1c00
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Po7 Desg FWD 10000 128.2287 P2p
Po8 Desg FWD 10000 128.2288 P2p

interface Port-channel3
switchport access vlan 2
switchport mode access
!
interface Port-channel4
switchport trunk allowed vlan 2,3,100,300,700,701,703-705
switchport mode trunk
!

!
interface Port-channel7
switchport trunk allowed vlan 2,23,705
switchport mode trunk
!
interface Port-channel8
switchport trunk allowed vlan 2,23,705
switchport mode trunk

Sorry, how to check the port roles?