Solved

HSRP messages on Netscreen

Posted on 2006-06-13
4
564 Views
Last Modified: 2008-01-09
I keep getting message on our netscreen as a spoof alert stating that two of our swithces are generating packets in the order of source " ip address of one of our switches" src port 1985 and destination addres of 224.0.0.2 dsn port of 1985. My question is how to prevent this message as a spoof or turn the multicast broadcasting off on the switches.

thanks in advance
0
Comment
Question by:vcon13
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
4 Comments
 
LVL 28

Expert Comment

by:mikebernhardt
ID: 16897305
You definitely don't want to block those packets- that's the hello protocol between the 2 switches. Block it and you won't have HSRP.

Not sure how to fix that issue on the netscreen, but it sounds like the problem is that the packets are on the outside of the netscreen but the netscreen is expecting them on the inside due to their source address. Without knowing your topology I can't really suggest further. You haven't said what brand of switches or anything. By default, multicast packets are treated as broadcasts on a switch. You can configure many Cisco switches so that only specific ports will be used for a particualr multicast group. So you may be able to supress them on the netscreen port that way. but the real problem is probably the design and how the netscreen fits into it with it's current configuration.
0
 
LVL 28

Expert Comment

by:mikebernhardt
ID: 16897328
you can also use IGMP snooping on the switches, which will help the switches figure out on which ports to send the multicast packets. It should stop sending them to the netscreen. But it won't stop arps and other possible broadcasts you may also be getting complaints about.
0
 

Author Comment

by:vcon13
ID: 16897797
Sorry, the switches are Cisco 4506 GBit, on the same subnet as the spoofed address. 10.10.10.0 we will use this subntet for this example. 6 interfaces on Netscreen. Inernas subnet is getting the message.
0
 
LVL 28

Accepted Solution

by:
mikebernhardt earned 500 total points
ID: 16898026
Hard to imagine why the Netscreen would have a problem with local addresses sending packets on the proper interface. The 4506s definitely do IGMP snooping, that may well fix the problem by keeping those multicast packets away from switchports that don't want to listen.
0

Featured Post

Turn your laptop into a mobile console!

The CV211 Laptop USB Console Adapter provides a direct Laptop-to-Computer connection for fast and easy remote desktop access with no software to install.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses
Course of the Month7 days, 22 hours left to enroll

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question