HSRP messages on Netscreen

I keep getting message on our netscreen as a spoof alert stating that two of our swithces are generating packets in the order of source " ip address of one of our switches" src port 1985 and destination addres of 224.0.0.2 dsn port of 1985. My question is how to prevent this message as a spoof or turn the multicast broadcasting off on the switches.

thanks in advance
vcon13Asked:
Who is Participating?
 
mikebernhardtConnect With a Mentor Commented:
Hard to imagine why the Netscreen would have a problem with local addresses sending packets on the proper interface. The 4506s definitely do IGMP snooping, that may well fix the problem by keeping those multicast packets away from switchports that don't want to listen.
0
 
mikebernhardtCommented:
You definitely don't want to block those packets- that's the hello protocol between the 2 switches. Block it and you won't have HSRP.

Not sure how to fix that issue on the netscreen, but it sounds like the problem is that the packets are on the outside of the netscreen but the netscreen is expecting them on the inside due to their source address. Without knowing your topology I can't really suggest further. You haven't said what brand of switches or anything. By default, multicast packets are treated as broadcasts on a switch. You can configure many Cisco switches so that only specific ports will be used for a particualr multicast group. So you may be able to supress them on the netscreen port that way. but the real problem is probably the design and how the netscreen fits into it with it's current configuration.
0
 
mikebernhardtCommented:
you can also use IGMP snooping on the switches, which will help the switches figure out on which ports to send the multicast packets. It should stop sending them to the netscreen. But it won't stop arps and other possible broadcasts you may also be getting complaints about.
0
 
vcon13Author Commented:
Sorry, the switches are Cisco 4506 GBit, on the same subnet as the spoofed address. 10.10.10.0 we will use this subntet for this example. 6 interfaces on Netscreen. Inernas subnet is getting the message.
0
All Courses

From novice to tech pro — start learning today.