Layer 2 Packet Loss Causuaweisded by Loops

Issue Description

Applicable Products and Versions:All products and versions.

Networking
As shown in Figure 4-3, a Huawei switch is connected to an enterprise network through a leased line. The switch functions as a Layer 2 aggregation switch, and an NE80 functions as the gateway.

Figure 4-3 Network where layer 2 packet loss occurs
QQ图片20170817095151

Layer 2 Packet Loss Caused by Loops.

Alarm Information

Enterprise network users complain that the network has a slow response to their service requests. When the NE80 pings a terminal on the enterprise network, packet loss occurs.

Handling Process

  1. Enable MAC address flapping detection on the switch and check alarms.NOTE:
    Alarm information differs for fixed and modular switches of different versions. The following alarm information is only used as an example.

    #Jul 28 09:59:34 2012 Switch L2IF/4/mac_flapping_alarm:OID 1.3.6.1.4.1.2011.5.25.42.2.1.7.12The mac-address has flap value . (BaseTrapSeverity=0, BaseTrapProbableCause=0, BaseTrapEventType=4, L2IfPort=549,entPhysicalIndex=1, MacAdd=0025-9e03-02f1,vlanid=107, FormerIfDescName=GigabitEthernet12/0/0,CurrentIfDescName=GigabitEthernet10/0/6,DeviceName= Switch)
    The preceding alarm information indicates that MAC address flapping occurs.

    2.  Set the NE80 MAC address to a static MAC address on GE12/0/0.

    The loop on the downstream network of GE10/0/6 is eliminated.

Root Cause

A loop exists on the downstream network of GE10/0/6. As a result, the MAC address of the NE80 flaps between GE10/0/6 and GE12/0/0 of the switch. When GE10/0/6 learns the MAC address of the NE80, user packets cannot be forwarded to the gateway.

Suggestions

To locate Layer 2 packet loss and intermittent disconnection problems, first check whether MAC address flapping occurs in addition to checking basic factors such as network cables, optical power of optical modules, and interface status. Then configure a static MAC address and check whether the problems are resolved. Configuring a static MAC address only prevents loops. To eliminate loops, configure a loop prevention protocol.

Layer 2 Loops Occur in Hot-Standby S9700 Networking

Issue Description

Two S9700s are deployed at the core layer in a new building of the customer. Two S5700s are deployed in the server area and connected to S9700-1 and S9700-2 through two links. The networking is as follows.

QQ图片20170817093359

After devices are commissioned based on the network plan, terminals cannot access services on servers.

Alarm Information

None

Handling Process

1. Replan the network, as shown in the following figure.

QQ图片20170817093501

  1. Enable MSTP, and configure instance 10 for VLAN 10 and instance 11 for VLAN 20. The default instance is 0.s
    3. Configure the links between S9700-1 and S5700-1 and between S9700-2 and S5700-2 to block packets of VLAN 20. Configure the links between S9700-2 and S5700-1 and between S9700-1 and S5700-2 to block packets of VLAN 10.
    4. Configure MSTP multi-instance to implement HSB and load balancing of core switches.
    (1) Configure S9700-1.
    stp instance 0 root primary
    stp instance 10 root primary
    stp instance 11 root secondary
    stp pathcost-standard legacy
    stp bpdu-protection
    stp tc-protection ea
    #
    stp region-configuration
    region-name SZPOST
    instance 10 vlan 10
    instance 11 vlan 20
    active region-configuration

    (2) Configure S9700-2.
    stp instance 0 root secondary
    stp instance 10 root secondary
    stp instance 11 root primary
    stp pathcost-standard legacy
    stp bpdu-protection enable
    stp tc-protection
    #
    stp region-configuration
    region-name SZPOST
    instance 10 vlan 10
    instance 11 vlan 20
    active region-configuration

    (3) Configure S5700-1.
    Stp enable
    stp instance 0 priority 8192
    stp instance 10 priority 8192
    stp instance 11 priority 8192
    stp bpdu-protection
    stp pathcost-standard legacy
    stp tc-protection
    #
    stp region-configuration
    region-name SZPOST
    instance 10 vlan 10
    instance 11 vlan 20
    active region-configuration
    #
    interface G3/0/0
    stp instance 11 cost 20000
    #
    interface G3/0/1
    stp instance 0 cost 20000
    stp instance 10 cost 20000
    #

    (4) Configure S5700-2.
    Stp enable
    stp instance 0 priority 8192
    stp instance 10 priority 8192
    stp instance 11 priority 8192
    stp bpdu-protection
    stp pathcost-standard legacy
    stp tc-protection
    #
    stp region-configuration
    region-name SZPOST
    instance 10 vlan 10
    instance 11 vlan 20
    active region-configuration
    #
    interface G3/0/0
    stp instance 11 cost 20000
    #
    interface G3/0/1
    stp instance 0 cost 20000
    stp instance 10 cost 20000

Root Cause

  1. Interfaces connecting S9700-1 and S9700-2 to the S5700s block packets.
    2. MSTP is enabled on the S9700s to prevent loops by default.
    3. Two S9700s and two S5700s form two Layer 2 loops in VLANs 10 and 20.

Suggestions

During switching network planning, you can use MSTP together with the multi-instance function to implement load balancing and prevent Layer 2 loops.

istack fault on S6700 due to optical module mismatch

Issue Description

When you attach 2 switch model s6700-48-EI using SFP+ SFP-10G-CU1M optical transceiver you get following error building iStack:

[STAR-25-A-stack-port0/1]port interface XGigabitEthernet 0/0/48 enable

Warning: Enabling stack port cause configuration loss on the interface, continue?[Y/N]:y

Error: Configuration failed. Please check optical module(s).

[STAR-25-A-stack-port0/1]dis transceiver interface XGigabitEthernet 0/0/48

 

XGigabitEthernet0/0/48 transceiver information:

————————————————————-

Common information:

  Transceiver Type               :1X_CopperPassive_SFP

  Connector Type                 :Copper Pigtail

  Wavelength(nm)                 :-

  Transfer Distance(m)           :1(copper)

  Digital Diagnostic Monitoring  :NO

  Vendor Name                    :TIMEINTERCONNECT

  Vendor Part Number             :D09181-4A      

  Ordering Name                  :

————————————————————-

Manufacture information:

  Manu. Serial Number            :D142460133     

  Manufacturing Date             :2014-09-03

  Vendor Name                    :TIMEINTERCONNECT

————————————————————-

[STAR-25-A-stack-port0/1]dis cu int XGigabitEthernet 0/0/48

#

interface XGigabitEthernet0/0/48

#

 

 

Alarm Information

Warning: Enabling stack port cause configuration loss on the interface, continue?[Y/N]:y

Error: Configuration failed. Please check optical module(s).

Handling Process

1) check if the module is certified by Huawei

2) Attach same optical module (same transceiver) for port grouped by 4.

Root Cause

You must use same transceiver  to port 45,46,47,48.

If you have 2 kind of transceiver on that ports you can’t make iStack work as aspected.

Solution

Unplug transceiver sfp (1Gb) if are connected on the same port grup (controlled by same hardware chip) use only SFP+ transceiver

Huawei S6700 series switch:

S6720-30C-EI-24S-AC

S6720-54C-EI-48S-AC

IP phone can’t power on through POE interface in S5700

Issue Description

When trying to power on IP Phones via PoE on a S5700-48TP-PWR-SI.
One model Cisco 7911 phone powers model higher than that do not power up.

QQ图片20170811164850

Current Interface Configurations are as follows:

#
interface GigabitEthernet0/0/3
undo negotiation auto
description PC
voice-vlan 4 enable
voice-vlan legacy enable
port hybrid pvid vlan 2
port hybrid tagged vlan 4
port hybrid untagged vlan 2
stp edged-port enable
port-security enable
port-security max-mac-num 3
trust 8021p
trust dscp
#

Alarm Information

No

Handling Process

  1. Confirm if switch checks compatibility between 802.3af and 802.3at Standards.
    a. By default the switch dies not check this feature.

    2. Run:
    <PoE>System-View
    [PoE] int gig 0/0/3
    [PoE-GigabitEthernet0/0/3] poe legacy enable

    Current Interface Configurations are as follows:

    #
    interface GigabitEthernet0/0/3
    undo negotiation auto
    description PC
    voice-vlan 4 enable
    voice-vlan legacy enable
    port hybrid pvid vlan 2
    port hybrid tagged vlan 4
    port hybrid untagged vlan 2
    stp edged-port enable
    poe legacy enable
    port-security enable
    port-security max-mac-num 3
    trust 8021p
    trust dscp
    #

Root Cause

  1. Confirm if PoE is supported by the Switch…
    a. (In this instance it is as some devices work using it.)

    2. Check if other devices (IP phones) are not faulty.
    a. (In this case the phones were working fine when connected on the Cisco switch.)

    3. Check what power requirement they need. E.g PoE standard 802.3af or 802.3at
    a. (in this due to time constraints and lack of material about vendor equipment this could not be verified.)

Solution

<PoE>System-View
[PoE] int gig 0/0/3
[PoE-GigabitEthernet0/0/3] poe legacy enable

Suggestions

No

Huawei PoE switch:

S5700-28X-PWR-LI-AC

S5700-28C-PWR-SI

S5700-28P-PWR-LI-AC

S5700-10P-PWR-LI-AC

S5700-24TP-PWR-SI

Interface is in RSTP mode while MSTP is activated on the switch

Issue Description

Customer had several questions:
1) Why are all interfaces in instance 0 while VLANs of this interface are in instance 1
2) While interface is in RSTP Mode while STP  mode is MSTP
3) Customer changed priority for instance 1, so S53-2 became Root-bridge, but RSTP switches in the ring still used S53-1 as  Root bridge. Why?

stp region-configuration
region-name Nano110
revision-level 1
instance 1 vlan 2048 to 2056
instance 2 vlan 2064 to 2072
instance 3 vlan 2080 to 2088
instance 4 vlan 2096 to 2104
 instance 5 vlan 2560 to 2568
 instance 6 vlan 2112 to 2124
instance 7 vlan 2128 to 2136
instance 8 vlan 2144 to 2152
instance 9 vlan 2160 to 2168
instance 10 vlan 3008 to 3016
active region-configuration

interface GigabitEthernet0/0/17 
description n110ch33

port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 2560 to 2568 

stp instance 5 cost 19
trust 8021p
storm-control broadcast min-rate 1 max-rate 500
storm-control multicast min-rate 1 max-rate 50000
storm-control interval 180
storm-control action shutdown
storm-control enable trap
storm-control enable log 

[A3-1102-GigabitEthernet0/0/17]display stp instance 0 
——-[CIST Global Info][Mode MSTP]——-
CIST Bridge         :16384.7054-f595-4910
Config Times        :Hello 2s MaxAge 20s FwDly 15s MaxHop 20
Active Times        :Hello 2s MaxAge 20s FwDly 15s MaxHop 20
CIST Root/ERPC      :4096 .7054-f595-4920 / 2
CIST RegRoot/IRPC   :16384.7054-f595-4910 / 0
CIST RootPortId     :128.1
BPDU-Protection     :Disabled
TC or TCN received  :5891
TC count per hello  :0
STP Converge Mode   :Normal
Share region-configuration :Enabled
Time since last TC  :0 days 0h:14m:55s
Number of TC        :2339
Last TC occurred    :Eth-Trunk1

—-[Port19(GigabitEthernet0/0/17)][FORWARDING]—-
Port Protocol       :Enabled
Port Role           :Designated Port
Port Priority       :128
Port Cost(Dot1T )   :Config=auto / Active=20000
Designated Bridge/Port   :16384.7054-f595-4910 / 128.19
Port Edged          :Config=default / Active=disabled
Point-to-point      :Config=auto / Active=true
Transit Limit       :147 packets/s
Protection Type     :None
Port STP Mode       :
RSTP  
Port Protocol Type  :Config=dot1s / Active=dot1s
BPDU Encapsulation  :Config=stp / Active=stp
PortTimes           :Hello 2s MaxAge 20s FwDly 15s RemHop 20
TC or TCN send      :6
TC or TCN received  :1
BPDU Sent           :463
TCN: 0, Config: 0, RST: 458, MST: 5
BPDU Received       :4
TCN: 0, Config: 0, RST: 4, MST: 0 

Contact information:

Telephone: 852-30623083
Email: Sales@Thunder-link.com
Supports@Thunder-link.com
Website: http://www.thunder-link.com

Inter-card NLB Service Forwarding Is Abnormal Because the G24SA Card of the S7700 Does Not Support NLB

Issue Description

[Version information]

QQ图片20170804141853

[Networking description]

1. The Huawei S7700s use CSS cards to establish a CSS as the core gateway of all services. The two chassis of the S7700 use cards of the same type and the slot distribution is the same. The figure shows the card type and slot distribution.

2. The Huawei S5700EI connects to the NLB server, and the NLB server works in multicast mode and the MAC address starts with 03BF. The downstream PC connected to the S5700LI needs to access the NLB server of which the MAC address starts with 03BF (the MAC address corresponds to a virtual IP address).

[Networking topology]

QQ图片20170804141953

[Key configuration script]

S7700:
#
arp static 10.28.38.102 03bf-0a1c-2666 vpn-instance Internal_Service
arp static 10.28.38.108 03bf-0a1c-266c vpn-instance Internal_Service
arp static 10.28.38.112 03bf-0a1c-2670 vpn-instance Internal_Service
arp static 10.28.38.132 03bf-0a1c-2684 vpn-instance Internal_Service
arp static 10.28.38.135 03bf-0a1c-2687 vpn-instance Internal_Service
arp static 10.28.38.141 03bf-0a1c-268d vpn-instance Internal_Service
arp static 10.28.38.105 03bf-0a1c-2669 vpn-instance Internal_Service
#
interface Eth-Trunk5
description To_Floor-S5700LI-01_Eth-trunk5
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 8 to 4094
#
interface Eth-Trunk40
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 103 400 to 499
traffic-policy test outbound
mac-address multiport 03bf-0a1c-2666 vlan 403
mac-address multiport 03bf-0a1c-2669 vlan 403
mac-address multiport 03bf-0a1c-266c vlan 403
mac-address multiport 03bf-0a1c-2670 vlan 403
mac-address multiport 03bf-0a1c-2684 vlan 404
mac-address multiport 03bf-0a1c-2687 vlan 404
mac-address multiport 03bf-0a1c-268d vlan 404
#
interface Vlanif100
description Management_IP
ip binding vpn-instance Internal_Service
ip address 172.21.32.1 255.255.255.0
#
interface Vlanif403
description IT_Server_04
ip binding vpn-instance Internal_Service
ip address 10.28.38.97 255.255.255.224
#

[Fault description]

The red line of the networking topology shows that the ping operation fails.

Handling Process

  1. Determine the node where packet loss occurs. Collect traffic statistics in the inbound direction of Eth-Trunk 5 and outbound direction of Eth-Trunk 40 on the S7700.

    Traffic statistics configuration script:

    #
    acl number 3000
    rule 5 permit ip source 172.21.32.10 0 destination 10.28.38.105 0
    #
    traffic classifier test operator or precedence 5
    if-match acl 3000
    #
    traffic behavior test
    permit
    statistic enable
    #
    traffic policy test
    classifier test behavior test
    #
    interface Eth-Trunk5
    traffic-policy test inbound
    #
    interface Eth-Trunk40
    traffic-policy test outbound
    #

    [S7700]dis traffic policy  statistics  interface  E
    th-Trunk 5 inbound
    Interface: Eth-Trunk5
    Traffic policy inbound: test
    Rule number: 1
    Current status: OK!
    Statistics interval: 300
    ———————————————————————
    Board : 1/1
    ———————————————————————
    Matched          |      Packets:                            42
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Passed         |      Packets:                            42
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Dropped        |      Packets:                             0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Filter       |      Packets:                             0
    |      Bytes:                               –
    ———————————————————————
    Car          |      Packets:                             0
    |      Bytes:                               –
    ———————————————————————
    Board : 2/1
    ———————————————————————
    Matched          |      Packets:                             0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Passed         |      Packets:                             0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Dropped        |      Packets:                             0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Filter       |      Packets:                             0
    |      Bytes:                               –
    ———————————————————————
    Car          |      Packets:                             0
    |      Bytes:                               –
    ———————————————————————

    [S7700]dis traffic policy  statistics  interface  E
    th-Trunk 40 outbound

    Interface: Eth-Trunk40
    Traffic policy outbound: test
    Rule number: 1
    Current status: OK!
    Statistics interval: 300
    ———————————————————————
    Board : 1/1
    ———————————————————————
    Matched          |      Packets:                            0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Passed         |      Packets:                            0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Dropped        |      Packets:                             0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Filter       |      Packets:                             0
    |      Bytes:                               –
    ———————————————————————
    Car          |      Packets:                             0
    |      Bytes:                               –
    ———————————————————————
    Board : 2/1
    ———————————————————————
    Matched          |      Packets:                             0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Passed         |      Packets:                             0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Dropped        |      Packets:                             0
    |      Bytes:                               –
    |      Rate(pps):                           0
    |      Rate(bps):                           –
    ———————————————————————
    Filter       |      Packets:                             0
    |      Bytes:                               –
    ———————————————————————
    Car          |      Packets:                             0
    |      Bytes:                               –
    ———————————————————————

    The preceding information shows that traffic is discarded on the S7700.

    When traffic arrives at XGE 1/3/0/4 of the S7700, the ping operation is normal.

    The two test results indicate that the type of the card where inbound traffic is transmitted is different. The fault may be relevant to the card.

    2. Perform the ping operation on the S7700 so that traffic is received by multiple identical VLANIF interfaces and different cards. The test result indicates that results of traffic received by the same Layer 3 interfaces on different card are different. Ping packets on the G24SA card are discarded, and ping packets on the X12SA card are normal.

    3. The G24SA card does not support NLB.

Root Cause

The ES0D0G24SA00 and ES0D0G24CA00 cards of the S7700 cannot connect to the clients or NLB server cluster.

Solution

The outbound interface of the NLB service is Eth-Trunk 40. Configure a traffic policy to redirect packets destined for the NLB virtual IP address to Eth-Trunk 40. The configuration script is as follows:

#
traffic classifier test operator or precedence 5
if-match acl 3000
#
traffic behavior test
permit
statistic enable
redirect interface Eth-Trunk40
#
traffic policy test
classifier test behavior test
#
traffic-policy test global inbound slot 1/1
traffic-policy test global inbound slot 2/1
#

Suggestions

Fault location:

1. Determine the faulty node by configuring traffic statistics collection and obtaining packets through mirroring.

2. Perform the comparison test to determine the problem.

Inserting two more switches into a stack system

Issue Description

This is guide about how to add two more switches into a stacking system avoiding business impact.  We will use S5700 LI switches and we will use service interfaces.

Let’s consider the following stacking system composed by S5700 LI switches connected using service interfaces.

QQ图片20170801145938

Stack port configuration:

QQ图片20170801150031

Alarm Information

none.

Handling Process

We will need to add the third unit  SWT3 (S5700LI) having below stack-port configuration and using Xgi2/0/4 we will connect it to xGi1/0/3.

QQ图片20170801150109

Steps:
1. Add Xgi1/0/3 to stack-port 1/1

QQ图片20170801150147

2. Save and power off SWT3
3. Plug in the stack cable. (between XGigabitEthernet2/0/4 and XGigabitEthernet1/0/3)
4. Power on SWT3

SWT1 and SWT2 are still running.
The new stack system, with 3 switches.

QQ图片20170801150515

The stack-port configuration:

QQ图片20170801150734

Now we will add the forth unit SWT4. We will configure stack-port as below, using XGigabitEthernet3/0/4 to connect with XGigabitEthernet2/0/3.

QQ图片20170801150831

Steps:
1. save and power off SWT4
2. plug the stack cable between Xgi3/0/4 and Xgi2/0/3
3. power on SWT4.

The stack system is still running while adding the new device.QQ图片20170801150920

wait for a couple of minutes….
Finish!

QQ图片20170801151020

Stack port configuration:

QQ图片20170801151114

Stack topology:

QQ图片20170801151149

Hope you will find this case useful!

Root Cause

none.

Suggestions

none

S5700-LI:

S5700-28P-LI-AC

S5700-28P-LI-DC

S5700-28X-LI-24S-AC

S5700-28X-LI-AC