Solved

MAC Flap on 3750 L2 Switch

Posted on 2010-09-21
6
2,072 Views
Last Modified: 2012-06-21
(See attached picture)
I have a 4948-10G acting as a Router for my customers Gateway on Vlan 51
I Trunk Vlan51 and several others to a 3750-12S for GIG SPF L2 aggregation.
from there, I trunk the exact same Vlans to a 3560, and 2 3400M switches for L2 endpoints.

my problem is that i constantly get this syslog message from my 3750-12S:
SW_MATM-4-MACFLAP_NOTIF: Host 001f.ca74.977f in vlan 51 is flapping between port Gi1/0/1 and port Gi1/0/12
Port 1/0/12 is my trunk back to the 4948-10G, and port 1/0/1 is my trunk to the 3560.  
the mac address in the log message is the mac address of the VLAN interface on my 4948-10G.

I have absolutely no problems network wise that would indicate that this is a problem.  I would like to fix the issue so that my syslog is clean. In all common sense, I would think that it would be NORMAL for the 3750 to see that mac address on both ports, and actually see it on the other two ports going to the 3400M's also but I don't. any ideas??
 Network Drawing
0
Comment
Question by:HunTelWebProgrammer
  • 3
  • 2
6 Comments
 
LVL 1

Accepted Solution

by:
Dmapros earned 167 total points
Comment Utility
It sounds like the 4948 could be connected to the 3560 creating a loop. Can you run the command 'SH CDP NEIGH' on the 4948 and look for the names of the 3560. If it is found you will know which port it is being found on.
0
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 333 total points
Comment Utility
If it's a loop, the same message should be showing up on the 4948 and the 3560 which would direct you to the link between those switches.

Then again, unless you have enabled portfast and BPDU filter on the switches in question, spanning-tree would be blocking the ports.
0
 
LVL 1

Author Comment

by:HunTelWebProgrammer
Comment Utility
these switches reside in separate towns several miles apart, I would know if they were connected to each other twice because i would be using more than 1 pair of fiber between towns to get to them.  (small detail i forgot to mention, sorry)  CDP neighbors are clean, and I have spanning-tree blocked on all trunks for this leg of the network, spanning tree is only enabled on the 10G trunks on the 4948 that is not part of this equasion.   Also, since i have no network issues, a loop is unlikely.  we have never used 3750's before in our network, and was wondering if there was just something special i needed to do to it for my specific application.   again, the message in syslog I get (stated above)  sounds legit,  i would think the switch would see the gateway of vlan 51 on ALL its trunk ports.  would changing the management VLAN on the 3750 to something other than 51 solve my syslog messages you think??
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 333 total points
Comment Utility
If you're getting a MAC flap message, 99.99% of the time, it's a loop.

The only other possibility is two devices with the same MAC address.

And depending on the topology, configuration and traffic, it is possible to have a loop and no other apparent network issues.

I would look at the logs of the 3560. You could have a loop between two VLAN51 ports on that device.



0
 
LVL 1

Author Comment

by:HunTelWebProgrammer
Comment Utility
i changed the management interface to a different subnet, and it went away. there was no loop.
0
 
LVL 1

Author Closing Comment

by:HunTelWebProgrammer
Comment Utility
the network loop was not my issue.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Suggested Solutions

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now