Switch Loop preventing DOS

sstringham
sstringham used Ask the Experts™
on
I have a bunch of 3560 POE switches in my network. The individual ports are configured with voice vlans and data vlans. We had a user plug a cheap microswitch (netgear, linksys, etc.) into the back of the phone, and then their PC, printer, etc. into that. The phone is connected to the switch.

They had a loose cable that was plugged into something else earlier and thought that needed to be plugged in. This created a switching loop in the microswitch. Well, it brought that whole LAN segment down due to the broadcast/traffic storm loop.

What can I do to prevent this in the future. As the microswitch is not participating in STP, and neither is the phone?


interface FastEthernet0/5
 switchport access vlan XX
 switchport mode access
 switchport voice vlan YY
 priority-queue out
 mls qos trust dscp
 spanning-tree portfast

Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Add line
 spanning-tree bpduguard enable

to all ports that you do not want users to connect switches to.  If the port sees a BPDU packet from a newly connected switch port will shutdown in a error-disable state.  Then you can go talk to user and if they need a switch you can connect it correctly and re-enable switch.
Les MooreSr. Systems Engineer
Top Expert 2008

Commented:
You can also setup port security to only allow 2 mac-addresses (the phone and 1 pc)
Agreed.
PMI ACP® Project Management

Prepare for the PMI Agile Certified Practitioner (PMI-ACP)® exam, which formally recognizes your knowledge of agile principles and your skill with agile techniques.

Aaron StreetTechnical Infrastructure Architecture and Global Network Manager
Commented:
well do you want the micro switch on the network?

eneabling BDPU guard will prevent it working...


also port security will not stop this happening. looping a cable back in to the micro switch will not be detected by it. the loop on the micorswich will just cause a loop, it will not add any more mac-addresses to the network. and deffinetly non that will be seen by the 3560.

you can enable rate limiting features on the 3560, this would allow you to limit how many packets can come acroos the interface to the micro switch. so although it will not prevent loops it will limit the effect to the rest of the network.

you coudl also enable err-disabable storm detect storm control. this will detect braodcast storms on a link and shut that link down.
there is also err-disabable unicast-flood.

bit more info here

http://supportwiki.cisco.com/ViewWiki/index.php/How_to_configure_broadcast_suppression_or_traffic_storm_control_in_Cisco_Catalyst_switches

Aaron StreetTechnical Infrastructure Architecture and Global Network Manager

Commented:
oh only the link to IOS 12.1 and before seems to work?? however if you find your switch manual it will have the updated commands and knowing IOS they will be almost identical to the ones above. (using a few ?'s you should be able to get it sorted)
Aaron StreetTechnical Infrastructure Architecture and Global Network Manager

Commented:
the command from a switch is

#int f1/0/3
#storm-control broadcast [number of packets that you want the limit to be]
#storm-control action shutdown

you can also use the same command to limit unicast and multicast. (good for detecting loops )
all you need to do is look to see waht your background level of broadcasts are. then times this by 2 or 3 to insure you have anice buffer and you should be fine.

A true broadcast storm will incress packet levels massivly.
switches at desktop sometimes neccessary evil.  Good to control installations so BPDU guard good way to make sure no one does it without ones control

Author

Commented:

I then recreated the scenario on my lab switch (cisco 3560 <-> Phone <-> microswitch). I then put a cable loop into the microswitch. It drove the switch nuts, and the port did not shut down. It bounced a few times though.

I then implemented the bpduguard. Then, reintroduced the loop. The port was shut down within 2 seconds in an err-disable state. Perfect.

I implemented the BPDUGuard as a default on my floor switches.  So:
Conf t
spanning-tree portfast bpduguard default
end
wr mem


I tried the problem in production, and again, a disabled port.

Thanks folks for the recommendation.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial