Mailing List Archive: nsp: extreme

Extreme switch "show iparp" - IP Rejected

Index | Next | Previous | View Threaded

rootnet08 at gmail

Jul 19, 2012, 9:54 PM

Post #1 of 6 (968 views)
Permalink

Extreme switch "show iparp" - IP Rejected

Hello,

I am faced with a weird issue where the switch has rejected an IP address
for the provider located on a router, which stopped the BGP TCP session. I
could still ping and access all devices on Switch C but not that provider
for some reason. Has anyone seen this or know how to prevent this from
happening?

To be clear the /30 IP secondary on the interface was rejected.

Here is the scenario:

3 switches, 1 router in question. No other devices having trouble. It's
configured this way due to the geographical separation and limited space at
other location where provider is so the BGP router could not be closer to
Internet source. (will change soon)

Visual:

provider -> switch C - < transport > switch B -> switch A -> main router

Provider assigned a /30 say 172.16.0.0/30 -> his IP is say 172.16.0.1/30
Switch A is not assigned an IP on the /27. This switch is simple all L2
(tagged/untagged or trunk/access ports)
Switch B is assigned an IP from a /27 say 192.168.0.4/27
Switch C is assigned an IP from a /27 say 192.168.0.2/27
Main Router is assigned an IP from a /27 say 192.168.0.1/27 and the
secondary IP is 172.16.0.2/30

VLANs

inet (which is to isolated the provider connection)
transport (which is to back-haul across the network)

Switch A has VLAN transport and inet
Switch B has VLAN transport and inet
Switch C has VLAN transport and inet
Router is doing InterVLAN routing into Switch A.

I have Internet connectivity from provider on say port 50 of Switch C. I
have a loop going back to my main BGP peering router on port 1 of Switch C.
I do simple vlan tagging on this switch to get the traffic back to the
router.

Port 50 is a VLAN inet
Port 1 is a VLAN transport

Since Port 1 is transporting traffic back to the main BGP peering router
the port is set for tagged for vlans inet and transport
Since Port 50 is the connection to a provider it is tagged for port 1 to
backhaul the traffic.

As you can tell from the visual there are three switches in between the
inet provider and main BGP peering router. BTW Switch A is an old Cisco
(it's purpose is only for L2) that will be decommissioned soon and all
circuits moved to Switch B which is an extreme switch. Switch C is also an
extreme switch.

This has worked perfectly no issues since we've added the provider and
Switch C.

I have substituted the ip address out of the router and mac address as well
as vlan name for fictitious ones.

sh iparp
Destination Mac Age Static VLAN [VID] Port
192.168.0.1 mac-address-here 0 NO vlan-name-here [0002] 1
Dynamic Entries: 1 Static Entries: 0
Pending Entries: 0
Out Request: 16 Out Response: 11
In Request: 1875 In Response: 19
Proxy Answered: 0
Rx Error: 0 Dup IP Addr: 0
Rejected count: 480 Rejected IP: 172.16.0.2
Rejected Port: 1 Rejected I/F: transport

Any help is appreciated!

robl at lentil

Jul 20, 2012, 1:12 AM

Post #2 of 6 (929 views)
Permalink

Re: Extreme switch "show iparp" - IP Rejected [In reply to]

Config snippets may help to work this out.

By 'secondary IP' how is this configured on the cisco, and why?

Rob

--
Robert Lister

> Provider assigned a /30 say 172.16.0.0/30 -> his IP is say 172.16.0.1/30
> Switch A is not assigned an IP on the /27. This switch is simple all L2 (tagged/untagged or trunk/access ports)
> Switch B is assigned an IP from a /27 say 192.168.0.4/27
> Switch C is assigned an IP from a /27 say 192.168.0.2/27
> Main Router is assigned an IP from a /27 say 192.168.0.1/27 and the secondary IP is 172.16.0.2/30
>
>
> sh iparp
> Destination Mac Age Static VLAN [VID] Port
> 192.168.0.1 mac-address-here 0 NO vlan-name-here [0002] 1
> Dynamic Entries: 1 Static Entries: 0
> Pending Entries: 0
> Out Request: 16 Out Response: 11
> In Request: 1875 In Response: 19
> Proxy Answered: 0
> Rx Error: 0 Dup IP Addr: 0
> Rejected count: 480 Rejected IP: 172.16.0.2
> Rejected Port: 1 Rejected I/F: transport

erik at bais

Jul 20, 2012, 2:08 AM

Post #3 of 6 (931 views)
Permalink

Re: Extreme switch "show iparp" - IP Rejected [In reply to]

Hi,

You may want to test with disabling IPARP checking on the L3 vlan’s.

A L3 vlan will by default only allow IP addresses that it has configured on the vlan.

If you want to mix L2 and L3 functionality across the same vlan type:

disable iparp vr VR-Default checking

That is a switch wide command, so you basically disable it for the complete switch.

Perhaps it is better to change to a second vlan and have that vlan only travel in L2 across switch A, B and C.
L2 only vlan’s don’t do IPARP checking.

Hope this helps,
Regards,
Erik Bais

From: extreme-nsp-bounces [at] puck [mailto:extreme-nsp-bounces [at] puck] On Behalf Of Robert Lister
Sent: vrijdag 20 juli 2012 10:13
To: root net
Cc: Extreme NSP
Subject: Re: [e-nsp] Extreme switch "show iparp" - IP Rejected

Config snippets may help to work this out.

By 'secondary IP' how is this configured on the cisco, and why?

Rob

--
Robert Lister

Provider assigned a /30 say 172.16.0.0/30<http://172.16.0.0/30> -> his IP is say 172.16.0.1/30<http://172.16.0.1/30>
Switch A is not assigned an IP on the /27. This switch is simple all L2 (tagged/untagged or trunk/access ports)
Switch B is assigned an IP from a /27 say 192.168.0.4/27<http://192.168.0.4/27>
Switch C is assigned an IP from a /27 say 192.168.0.2/27<http://192.168.0.2/27>
Main Router is assigned an IP from a /27 say 192.168.0.1/27<http://192.168.0.1/27> and the secondary IP is 172.16.0.2/30<http://172.16.0.2/30>

sh iparp
Destination Mac Age Static VLAN [VID] Port
192.168.0.1 mac-address-here 0 NO vlan-name-here [0002] 1
Dynamic Entries: 1 Static Entries: 0
Pending Entries: 0
Out Request: 16 Out Response: 11
In Request: 1875 In Response: 19
Proxy Answered: 0
Rx Error: 0 Dup IP Addr: 0
Rejected count: 480 Rejected IP: 172.16.0.2
Rejected Port: 1 Rejected I/F: transport

rootnet08 at gmail

Jul 20, 2012, 9:16 AM

Post #4 of 6 (934 views)
Permalink

Re: Extreme switch "show iparp" - IP Rejected [In reply to]

The secondary IP is only configured because it's the /30 between the
provider and that BGP peering router.

interface Port-channel1.2
description transport vlan
encapsulation dot1Q 2
ip address 192.168.0.1 255.255.255.224

interface Port-channel1.3
description provider vlan
encapsulation dot1Q 3
ip address 192.168.1.1 255.255.255.252 secondary
ip address 172.16.0.2 255.255.255.252

One thing I forgot to mention is that VLAN transport is a L3 VLAN. This was
really only to ping Switch C on VLAN transport.

On Fri, Jul 20, 2012 at 3:12 AM, Robert Lister <robl [at] lentil> wrote:

>
> Config snippets may help to work this out.
>
> By 'secondary IP' how is this configured on the cisco, and why?
>
> Rob
>
> --
> Robert Lister
>
>
> Provider assigned a /30 say 172.16.0.0/30 -> his IP is say 172.16.0.1/30
> Switch A is not assigned an IP on the /27. This switch is simple all L2
> (tagged/untagged or trunk/access ports)
> Switch B is assigned an IP from a /27 say 192.168.0.4/27
> Switch C is assigned an IP from a /27 say 192.168.0.2/27
> Main Router is assigned an IP from a /27 say 192.168.0.1/27 and the
> secondary IP is 172.16.0.2/30
>
>
> sh iparp
> Destination Mac Age Static VLAN [VID] Port
> 192.168.0.1 mac-address-here 0 NO vlan-name-here [0002] 1
> Dynamic Entries: 1 Static Entries: 0
> Pending Entries: 0
> Out Request: 16 Out Response: 11
> In Request: 1875 In Response: 19
> Proxy Answered: 0
> Rx Error: 0 Dup IP Addr: 0
> Rejected count: 480 Rejected IP: 172.16.0.2
> Rejected Port: 1 Rejected I/F: transport
>
>

rootnet08 at gmail

Jul 20, 2012, 9:18 AM

Post #5 of 6 (926 views)
Permalink

Re: Extreme switch "show iparp" - IP Rejected [In reply to]

Correction - to ping Switch C on vlan provider not transport.

On Fri, Jul 20, 2012 at 11:16 AM, root net <rootnet08 [at] gmail> wrote:

> The secondary IP is only configured because it's the /30 between the
> provider and that BGP peering router.
>
> interface Port-channel1.2
> description transport vlan
> encapsulation dot1Q 2
> ip address 192.168.0.1 255.255.255.224
>
> interface Port-channel1.3
> description provider vlan
> encapsulation dot1Q 3
> ip address 192.168.1.1 255.255.255.252 secondary
> ip address 172.16.0.2 255.255.255.252
>
> One thing I forgot to mention is that VLAN transport is a L3 VLAN. This
> was really only to ping Switch C on VLAN transport.
>
>
>
> On Fri, Jul 20, 2012 at 3:12 AM, Robert Lister <robl [at] lentil> wrote:
>
>>
>> Config snippets may help to work this out.
>>
>> By 'secondary IP' how is this configured on the cisco, and why?
>>
>> Rob
>>
>> --
>> Robert Lister
>>
>>
>> Provider assigned a /30 say 172.16.0.0/30 -> his IP is say 172.16.0.1/30
>> Switch A is not assigned an IP on the /27. This switch is simple all L2
>> (tagged/untagged or trunk/access ports)
>> Switch B is assigned an IP from a /27 say 192.168.0.4/27
>> Switch C is assigned an IP from a /27 say 192.168.0.2/27
>> Main Router is assigned an IP from a /27 say 192.168.0.1/27 and the
>> secondary IP is 172.16.0.2/30
>>
>>
>> sh iparp
>> Destination Mac Age Static VLAN [VID] Port
>> 192.168.0.1 mac-address-here 0 NO vlan-name-here [0002] 1
>> Dynamic Entries: 1 Static Entries: 0
>> Pending Entries: 0
>> Out Request: 16 Out Response: 11
>> In Request: 1875 In Response: 19
>> Proxy Answered: 0
>> Rx Error: 0 Dup IP Addr: 0
>> Rejected count: 480 Rejected IP: 172.16.0.2
>> Rejected Port: 1 Rejected I/F: transport
>>
>>
>

rootnet08 at gmail

Jul 20, 2012, 9:51 AM

Post #6 of 6 (924 views)
Permalink

Re: Extreme switch "show iparp" - IP Rejected [In reply to]

Perhaps you are right. There really wasn't a need to have provider VLAN be
L3 outside of pinging that VLAN in the initial stages. I will remove the IP
and make it solely L2 VLAN.

Thanks for the help.

On Fri, Jul 20, 2012 at 4:08 AM, Erik Bais <erik [at] bais> wrote:

> Hi, ****
>
> ** **
>
> You may want to test with disabling IPARP checking on the L3 vlan�s. ****
>
> ** **
>
> A L3 vlan will by default only allow IP addresses that it has configured
> on the vlan. ****
>
> ** **
>
> If you want to mix L2 and L3 functionality across the same vlan type: ****
>
> ** **
>
> disable iparp vr VR-Default checking ****
>
> ** **
>
> That is a switch wide command, so you basically disable it for the
> complete switch. ****
>
> ** **
>
> Perhaps it is better to change to a second vlan and have that vlan only
> travel in L2 across switch A, B and C. ****
>
> L2 only vlan�s don�t do IPARP checking. ****
>
> ** **
>
> Hope this helps,****
>
> Regards,****
>
> Erik Bais ****
>
> ** **
>
> *From:* extreme-nsp-bounces [at] puck [mailto:
> extreme-nsp-bounces [at] puck] *On Behalf Of *Robert Lister
> *Sent:* vrijdag 20 juli 2012 10:13
> *To:* root net
> *Cc:* Extreme NSP
> *Subject:* Re: [e-nsp] Extreme switch "show iparp" - IP Rejected****
>
> ** **
>
> ** **
>
> Config snippets may help to work this out.****
>
> ** **
>
> By 'secondary IP' how is this configured on the cisco, and why?****
>
> ** **
>
> Rob
>
> -- ****
>
> Robert Lister****
>
> ** **
>
> Provider assigned a /30 say 172.16.0.0/30 -> his IP is say 172.16.0.1/30
> Switch A is not assigned an IP on the /27. This switch is simple all L2
> (tagged/untagged or trunk/access ports)
> Switch B is assigned an IP from a /27 say 192.168.0.4/27
> Switch C is assigned an IP from a /27 say 192.168.0.2/27
> Main Router is assigned an IP from a /27 say 192.168.0.1/27 and the
> secondary IP is 172.16.0.2/30
>
>
> sh iparp
> Destination Mac Age Static VLAN [VID] Port
> 192.168.0.1 mac-address-here 0 NO vlan-name-here [0002] 1
> Dynamic Entries: 1 Static Entries: 0
> Pending Entries: 0
> Out Request: 16 Out Response: 11
> In Request: 1875 In Response: 19
> Proxy Answered: 0
> Rx Error: 0 Dup IP Addr: 0
> Rejected count: 480 Rejected IP: 172.16.0.2
> Rejected Port: 1 Rejected I/F: transport****
>
>

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads