MAC Addresses bleeding (for lack of a better term) between Cisco 2950 ports

Hello,

I have an Asus router on port 33 and a Netgear switch on 35 with the following configs:

int fa0/33
description ROUTER
switch access vlan 128
switchport mode access
switchport port-security
switchport port-security aging time 60
switchport port-security aging type inactivity
switchport port-security max 7
switchport port-security mac-address sticky

int fa0/35
description SWITCH
switch access vlan 128
switchport mode access
switchport port-security
switchport port-security aging time 60
switchport port-security aging type inactivity
switchport port-security max 16
switchport port-security mac-address sticky

Open in new window


Port 35 randomly is disabled.  If I do a SHUT/NO SHUT, it will stay on for a while then disable again.

On the router attached to 33, I have the modem attached to it and nothing else other than the connection going to the 2950, but SH MAC-ADDRESS-TABLE shows 7 MAC addresses.  Why?

On the switch attached to 35, I have a total for 3 devices attached to the 16-port Netgear switch.

A MAC address which is on port 33 keeps shutting down port 35.

I am sure I am doing something wrong here, but what?

Please advise.

Have a great day,

Don
GEMCCAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Don JohnstonInstructorCommented:
A diagram might help...

On the router attached to 33, I have the modem attached to it and nothing else other than the connection going to the 2950, but SH MAC-ADDRESS-TABLE shows 7 MAC addresses.

How is the router configured?  If all the ports of the router are layer 3 ports, then you should never see any MAC address on port 33 other than the router's.

On the switch attached to 35, I have a total for 3 devices attached to the 16-port Netgear switch.

A MAC address which is on port 33 keeps shutting down port 35.
It would seem there is a connection between the router (or 2950 switch) and the netgear switch.  Maybe not a direct physical link, but a connection none the less. Perhaps there are some wireless connections?
1
GEMCCAuthor Commented:
Hello,

No, the router is not Layer 3.

The router is wireless and there is an AP attached to the Netgear switch.  Should I up the switchport port-security max from 7 to 8 on port 33 (the one the router is attached)?

Thanks for your help.

Don
0
Don JohnstonInstructorCommented:
Should I up the switchport port-security max from 7 to 8 on port 33 (the one the router is attached)?
No.  You need to find and eliminate the loop. Otherwise you'll keep chasing the symptom.

You're going to have to figure out how to stop traffic from passing between the wireless part of the router and the AP on the Netgear switch.
1
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

GEMCCAuthor Commented:
Can you give me a hint as to what to do?
0
Don JohnstonInstructorCommented:
What brand/model router and AP?
0
GEMCCAuthor Commented:
Router Asus RT-AC66U
AP Netgear WN802T v2

Thanks for your help.

Don
0
Don JohnstonInstructorCommented:
Hard to say for sure because I'm not familiar with those boxes.

It might be worthwhile to confirm that this is indeed the problem. Can you shutdown the AP and see if the problem stops?

How far apart is the AP from the wireless router?

Did you set these up? Because usually getting an AP's to move data between themselves requires a bit of configuration.
0
JustInCaseCommented:
Looks to me that your port probably are error-disabled, since you have port-security configured on them. Shut/no shut is the way to deal with err-disabled ports if errdisable recovery  is not configured.

#switchport port-security violation shutdown
is default on Cisco switches, and therefore it is not listed in port configuration.
To avoid shutdown you can use
#switchport port-security violation protect
it will block new access when address table reach max MAC addresses.

To check are ports error disabled, when port is down issue
#show interfaces status

As it is configured port 33 can have just 7 mac addresses, and port 35 can have 16 mac addresses. You can reduce aging time to 5 or 10 minutes (from 60), so from last activity of that MAC address and MAC addresses can be faster forgotten.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
GEMCCAuthor Commented:
OK, so this is what I did.  I complete disconnected and turned off the AP.  Now the port that the router is attached to randomly gets disabled.

Needless to say, the ports are error-disabled and want them to be

I'm stumped.
0
JustInCaseCommented:
What I want to say with using protect  instead of shutdown is - as long as you are testing your config and it is not fully operational maybe it is better to go with protect ... I guess your customer need network access while you try to  figure out what to do next, and solve this puzzle. :)
Network will be at least partially functional.
0
GEMCCAuthor Commented:
Fixed the problem
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Switches / Hubs

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.