Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

HSRP messages on Netscreen

Posted on 2006-06-13
4
Medium Priority
?
577 Views
Last Modified: 2008-01-09
I keep getting message on our netscreen as a spoof alert stating that two of our swithces are generating packets in the order of source " ip address of one of our switches" src port 1985 and destination addres of 224.0.0.2 dsn port of 1985. My question is how to prevent this message as a spoof or turn the multicast broadcasting off on the switches.

thanks in advance
0
Comment
Question by:vcon13
  • 3
4 Comments
 
LVL 28

Expert Comment

by:mikebernhardt
ID: 16897305
You definitely don't want to block those packets- that's the hello protocol between the 2 switches. Block it and you won't have HSRP.

Not sure how to fix that issue on the netscreen, but it sounds like the problem is that the packets are on the outside of the netscreen but the netscreen is expecting them on the inside due to their source address. Without knowing your topology I can't really suggest further. You haven't said what brand of switches or anything. By default, multicast packets are treated as broadcasts on a switch. You can configure many Cisco switches so that only specific ports will be used for a particualr multicast group. So you may be able to supress them on the netscreen port that way. but the real problem is probably the design and how the netscreen fits into it with it's current configuration.
0
 
LVL 28

Expert Comment

by:mikebernhardt
ID: 16897328
you can also use IGMP snooping on the switches, which will help the switches figure out on which ports to send the multicast packets. It should stop sending them to the netscreen. But it won't stop arps and other possible broadcasts you may also be getting complaints about.
0
 

Author Comment

by:vcon13
ID: 16897797
Sorry, the switches are Cisco 4506 GBit, on the same subnet as the spoofed address. 10.10.10.0 we will use this subntet for this example. 6 interfaces on Netscreen. Inernas subnet is getting the message.
0
 
LVL 28

Accepted Solution

by:
mikebernhardt earned 2000 total points
ID: 16898026
Hard to imagine why the Netscreen would have a problem with local addresses sending packets on the proper interface. The 4506s definitely do IGMP snooping, that may well fix the problem by keeping those multicast packets away from switchports that don't want to listen.
0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen some questions on problems with SSH/telnet access to Cisco routers that may occur despite the fact that from a PC connected to your LAN, Internet connectivity is in place and users can access Internet sites without any issues.  There are…
In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

783 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question