Cisco Switching/Routing :: 2960G / 3650G - Non-broadcast Traffic Appearing Across VLAN
Jul 5, 2012
We run a network of several 2960G and 3650G switches in a network with a number of VLANs. One one particular VLAN (let's call it VLAN 10) it appears that non-broadcast traffic (i.e. normal unicast traffic) is being copied to every port in VLAN 10 only on one switch . The traffic is not crossing trunk ports and does not appear on other switches that have ports in VLAN 10. We first spotted this by noticing that a UPS port had an unusual amount of activity on our port througput graphs:
This traffic at 4 am is not expected and this profile is repeated across all ports in VLAN 10 on this switch (a WS-C2960S-48TD-L stack running IOS 15.0(1)SE3)\iffed one port using local SPAN (the UPS port) and discovered that this traffic was not broadcast, which was running at a normal low rate at all times. The traffic appeared to be unicast traffic from other ports of the sort you might see on a hub. It was from various hosts that live on VLAN 10, most (not all) of the conversations had one end station homed on the 'problem' switch. There are about 800 non-broadcast packets per hour and this is a busy VLAN so it does not account for all the traffic on the VLAN.
View 3 Replies
ADVERTISEMENT
Oct 24, 2011
I have got a catalyst cisco 2960G series switch and via this switch I want to creat serveral vlans. I am getting a dhcp IP from a router and I want to setup my own vlan networks.
I plugged in the Ethernet cable that came from the dhcp router to port 16 of the cisco switch and configured the ports 1,2 and 3 for vlan 1, 2 and 3
the dhcp router has given me this IP 192.168.10.158 defautl gateway is : 192.168.10.1
when I plug in a PC to port 1 or 2 of the cisco switch I still receiving the IP from range 192.168.10.* but not from the range that I configured for the vlan 1 or 2.
Below is my startup configuration:
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
[code].....
View 28 Replies
View Related
Aug 8, 2012
Multicasting. The configuration is I have a 6506 as my core switch receiving multicasts from an interface assigned to VLAN10. I have a monitor port setup with a PC running Observer which says multicasts are being received on the core switch. On a different interface on the core switch I have a 2960G switch connected to it and this interface is on VLAN 10. The 2960G switch has a workstation connected to it that needs to receive the multicasts. How do I configure the 6506 and/or the 2960G to process the multicast traffic?
View 0 Replies
View Related
Oct 23, 2011
I have used all the ports on my 24 port 2960G and need to extend it with another 2960G. These switches do not have trunk ports so what is the best way to stack them and have all 5 vlans on both switches.Can I just use a port Channel trunk etherchannel ?
View 7 Replies
View Related
Jan 25, 2012
I recently bought SG-300 28P to create the VLAN. My network hs 3 subnet 192.168.1.0, 192.168.2.0 and 192.168.3.0.My main net work is 192.168.1.0. I want to divide it to VLAN to eliminate the boardcast storm; especially from the domain 192.168.3.0
But I want all the devices from 192.168.1.0 to access other subnet.
View 4 Replies
View Related
Feb 23, 2012
We have 2 switches split across 2 datacentres connected via an interconnect. Over the past couple of days the interconnect provider's Cisco kit has shut down our port (err-disabled) due to a broadcast storm. They had the level set at 1 which I thought was a bit low. They say they tried to set to 2, then 5 but still kept tripping the storm-control feature so they set at 10. They say they've always had it set at 1% (on a 100Mb switch) and so we must be generating more broadcast traffic.
I'm trying to identify where the broadcast traffic is coming from. On our Cisco 3750 I've clear interface counters and when I do a sh run | i broadcasts there are a few ports which have what seems like a high broadcast count. The one port that is especially high and the only one tripping the storm-control feature (I've enabled on all our ports to try to identify where the traffic is coming from) is the port connected to the 100Mb interconnect. I've mirrored that port to another port and connected a server with wireshark so I can capture all the traffic across that port.
What I'm struggling to find is the source of the broadcast traffic.I have a few questions are these broadcasts layer 3 or layer 2 broadcasts. Also in the output below when it says broadcasts received is this inbound to the port i.e. from the connected device or is this a total of inbound and outbound broadcasts.
When I use wireshark and filter the capture on broadcasts (ff:ff:ff:ff:ff:ff) I see only 200-300 compared to the thousands the switch is reporting.If I filter on the broadcast IP address I also don't see the numbers corresponding to what I see in the show interface output.
GigabitEthernet1/0/1 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 0014.a93f.7401 (bia 0014.a93f.7401)
Description: Interconnect
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 4/255, rxload 44/255
Encapsulation ARPA, loopback not set
[code].....
also I'm currently doing : monitor session 1 source int g1/0/1 both, and also tried just rx incase I just need to be looking at receive traffic but still nothing is standing out.
View 10 Replies
View Related
Dec 17, 2012
How do I limit broadcast/mulitcast traffic on a switchport to e.g. 5000 pps ? I don't want the port to shut down, just block or drop broadcast traffic that exceeds 5000 pps.
View 19 Replies
View Related
Dec 28, 2011
I'm trying to trunk Fa0/3 port of 3524XL switch and Gi0/1 port of 3650G, below are the commands used. [code]
The issue is VTP not getting propogated into the Cisco 3650G switch so I'm not getting the VLAN database from my Cisco Core Switch 6500. Am I missing anything in the configuration???
View 2 Replies
View Related
Jun 27, 2012
I recently lost my configuration when attempting to reset the password for our Cisco 3560g switch, the switch connects to a Cisco 4506 switch via fiber back to our main office.
I have the switch temporarily routing all traffic to our 4506 by using the default route of 0.0.0.0 0.0.0.0 10.10.10.254 but the same switch is connected to a cisco 2600 router that is on a 10.10.20.0 network and the 3560g is on a 10.0.0.0 network.
Host computers sit on the 10.0.0.0 network, but they need to go to the 10.10.10.0 network for internet, domain, etc the same computers need to go to the 10.10.10.20 for remote connections and other services.
The address of the 3560g is: 10.0.0.254
The address of the 2600 is 10.10.20.2
When the default route is set to 0.0.0.0 0.0.0.0 10.10.10.254 (4560 switch) domain browsing works perfectly
When the default route is set to 0.0.0.0 0.0.0.0 10.10.20.2 (3560G) switch I can ping any ip address in that range and the address on the other
interface ip adresses on the 2600 (eg. 10.10.30.1 / eth2, 10.10.40.1/ eth3 etc.)
I have tried to weight the routes after adding them both to the configuration, but that doesn't seem to work at all.
The switch connects back to the office via vlan1 (10.10.10.253)
The 2600 is connected to port 1, which belongs to Vlan2 (10.10.20.1)
And client computers sit on ports 2-12 belonging to Vlan10 (10.0.0.240)
So in a nut shell, how would I go about setting it up so the machines on 10.0.0.0 can connect to 10.10.20.0 and 10.10.10.0 and vice versa at the same time? Everything was working fine until I rebooted the switch (3560g), which makes me think the person that configured this before me didn't save the running config to the start up config.
View 4 Replies
View Related
Feb 11, 2013
I have 2 hosts, 1 plugged in fa 0/21 in VLAN 101 and another in fa 0/22 in VLAN 101 on our L2 Cisco 2960. If I try and transfer files from either host the gig 0/1 trunk port on the 2960 leading tot he 3750 fa 0/1 port hits 100mb (using a real time bandwidth monitor tool), but why? This VLAN is on the same switch, why does it go one way up the trunk to the L3 3750 switch? The L3 3750 is the VTP server and the 2960 is a client. I would of thought the traffic stays local. The 2 hosts don't even have a gateway set.To sum up the typology the 2960 and 3750 are trunked using a single cable. The 3750 hangs of a ASA firewall using SVIs.Here is whatthe traffic looks like when copying a file between hosts (2gb file).
3750 L3 Switch (VTP Server)
interface FastEthernet1/0/4
description Trunk to Cisco 2960 Gig 0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
[code]....
View 6 Replies
View Related
Oct 10, 2012
Have a quick question regarding inter-vlan routing on a 3750. Overview of network is ISP --> ASA --> 3750 (acting as my core and default gw). I have 5 vlan interfaces on my 3750, all w/ 192.192.x.x subnets, a 6th w/ 192.168.100.x, and a 7th w/ 192.168.200.x. I have enabled "ip routing" on the switch and can successfully ping from subnet A to subnet B as long as both devices are using the correct DG for their vlan, which is the switch. I have a few ports that are trunked as well that go to ESX hosts which break out the vlans according to the subnet the vm should be attached to. The ASA is set to nat internal traffic for all the vlans.
Now my question: short of applying an ACL to each vlan interface to block traffic from other 192.192.x.x subnets is there a better way to accomplish this? I want my 192.168.10.x subnet to be able to reach all the subnets, but don't want 192.192.10.x to be able to talk to 192.192.20.x for example. I was thinking to create an acl like this:
access-list 120 permit ip 192.192.10.0 0.0.0.255 access-list 120 deny ip 192.192.0.0 0.0.255.255 192.192.10.0 0.0.0.255access-list 120 permit ip any 192.168.100.0 0.0.0.255 192.192.10.0 0.0.0.255
and then applying this to the interface for the appropriate vlan.
View 4 Replies
View Related
Jul 17, 2012
I have problems in my Cisco network until I connected some Moxa devices.This Moxa are models EDS-316 and EDS-208
My principal trouble is the traffic UDP. Suddently the network don't permit the traffic UDP in VLAN where are connected Moxa devices.
During an hour the Moxa can send TCP traffic, but can't send UDP. If a Moxa device is unplugged from network, all devices connected to him can work offile from principal network, but if I plugg again the Moxa is like disable.
After one hour (more or less) the system restart all functions and work fine.I catch the logs from TXerrorsInPorts and all the ports where is connected a Moxa have errors all time.
I don't know which is the problem, but I think that problem is in negotiation from Moxa to Cisco.This is the configuration from a port where is connected a Moxa: [code]
View 1 Replies
View Related
Jun 14, 2012
I have a requirement to monitor all traffic going from the internal LAN to the cloud. The LAN is a layer 2 VLAN which spans multiple Cisco 4507 switched and other smaller switches.
The VLAN has an IP address which the hosts use as the default gateway.
The exit port is on a Cisco 3600X switch connecrted to 4507 #1 via a 10G fiber link. 4507 #1 connects the rest of the LAN. Those switches interconnect via 10G fiber and 1G copper links.
Currently the monitor host is connected to a 1G copper port, configured as a monitor port, on one of the backside 4507s The switch manager says he has the switches configured so that I can see all traffic on the VLAN.
View 1 Replies
View Related
Apr 11, 2012
We have a switch gc2960. It has ports configured on vlan 27 and vlan 29.It is connected to switch ch3550. It has presence of vlan 27 vlan 29 and also vlan 18 and several other vlans.Our internet firewall is connected to ch3550. It is a fortinet product, so this is not indicated on the diagram.
When the two switches were connected on vlan 29 access ports, pc's on vlan 29 on gc2960 worked as expected. vlan 27 clients of course did not work.When we switched the connecting ports to trunk ports, some weird stuff happened. Clients on gc2960 on vlan 29 could ping and resolve dns, but not browse the intenet. The same was true for clients on gc2960 vlan 27. We verified that packets from the web were coming in through the firewall. What we were thinking, is that they somehow were not being tagged to vlan 29 even though we were trunking.
When we set native vlan 29 on the trunk, then clients on gc2960 vlan 29 operated as expected. However, clients on gc2960 vlan 27 are still having this problem, we can ping and resolve dns but not browse.Consider the other switch ch2960-jstreet which has presence of vlan 18 and vlan 27. It is also connected on trunk to ch3550. We are not using native vlan on this trunk, and traffic works as expected.Is the lack of presence of vlan 18 a factor as to why gc2960 is not receiving the tagged packets correctly? Should the interface vlan18 on gc2960 have an ip address on the vlan 18 network?
View 5 Replies
View Related
Nov 27, 2012
I want to know what is the best way to black traffic inside the same VLAN, this VLAN is a user VLAN, it means that I am talking about access layer.I wanted to use private vlan, but C2960S doesn't support this feature. Any other way to prevent any to any traffic in the user vlan, this vlan only have to speak at the Layer 3.
View 2 Replies
View Related
Jan 24, 2012
At present we are having a 4900 series switch where we are running one monitor session.Additionaly we are in need of capturing VLAN traffic and set the destination to 2 * GE ports , both are in the same switch.Due to the limitation of two monitor sessions per switch , we thought of putting the destination ports as port channel but it looks like it is not supported.
View 1 Replies
View Related
Feb 21, 2013
I have One switch 3750 and many switch 2960 c.I use one ASA 5510 to reach emote branche site (vpn conexion).I use one router 1841 for internet conexion.Router 1841, ASA and catalyst 2960 are connected on the 3750.Default gateway of all user is ASA IP
I configured Vlan 3750 and it work.Now I need to implement security : permit/block specific traffic between vlan [code] From vlan 72 I cannot have remote access on computer in vlan 34 and I cannot ping computer in vlan 34.
View 1 Replies
View Related
Nov 27, 2011
We have a pair of 6509 working in a VSS configuration (IOS 12.2(33)SX5). The 6509s connect to a pair of ASAs (7.2 code) running in an Active/Standby setup. These ASAs in turn connect to routers going to remote sites. I have configured Netflow on the following VLANS,
VLAN 10 - Servers Vlan
VLAN 9 - Transit/ASA VLAN (connects ASAs to 6509s). All traffic originating from any VLAN on the 6509 crosses this VLAN in order to reach remote sites and vice versa
I configured the netflow source VLAN 11 although I am not collecing any netflow from it.Although I have been getting lots of Netflow info, I noticed that netflow for traffic originating from any user VLAN on the 6509s going to any remote site via TRANSIT/ASA VLAN(9) does not get reported, I even tested with 4 GB traffic but no result. Only reverse traffic (i.e. from remote site to user VLAN) is reported as it traverses the Transit VLAN (9).
I read somewhere that egress netflow is not supported in 6500, but isnt traffic originating from a user vlan to a remote site via the transit VLAN (9) considered ingress with respect to the transit VLAN (9)? I would like to know whether bidirectional Netflow is supported on 6500 VLANS. I have mimimum control on routers beyond the ASAs, and since these ASAs run 7.2 code netflow is not supported, and Monitoring this Transit Vlan gives me extremely useful info.
I do get netflow biderectional traffic from the Server Vlan 10, but I think it is correlated by the netflow collector from vlans 9 and 10. [code]
View 9 Replies
View Related
Nov 13, 2011
I am trying to setup a network using Cisco 2960 switches with vlans configured. One vlan will handle video coming from four cameras that are connected to another 2960.
We have four cameras feeeding one port each on a 2960, that 2960 in turn feeds one port on the main 2960 which is the video vlan for that site. From the site it goes back to a Cisco 3750 to be sent over to a Sonicwall firewall. If we connect to the 2960 that the camera are connected to we can see the video, but not on the main site 2960.
View 5 Replies
View Related
Dec 18, 2011
I'm decommissioning my SonicWall PRO 3060 and upgrading to an ASA5550 (we're increasing our WAN link speed to 1Gig and need the 5550). In any case, I want to copy over the configuration from the PRO to the ASA. I have everything documented and I've started doing the changeover, but in looking at some other network diagrams on the net I'm seeing router symbols between the LAN switches and the ASA and I'm beginning to worry that I might need routers to do this which, of course, would increase cost quite a bit.
So my question is this: If I have a core switch carved into multiple VLANs and I connect each VLAN to a port on the ASA, will I be able to route and filter traffic from VLAN to VLAN through the ASA? If so how, in general, is this accomplished (I'm betting ACLs). I think that the ASA will be able to do this easily, but I just want to be sure before I get too far into the configuration of this unit,.
ASA
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
GigE0/0 GigE0/1 GigE0/2 GigE0/3 GigE1/0 GigE1/1 GigE1/2 GigE1/3
| | | | | | | |
| | | | | | | |
WAN BackupWAN VLAN400 VLAN500 VLAN600 VLAN700
View 4 Replies
View Related
Apr 22, 2013
I have pair of 5596 switches in vPC. One host say "HOST A" is connected to the primary vPC peer and other "HOST B" on secondary vPC peer.Both are in same VLAN 10. Both hosts are vpc orphan ports as their NIC is configured in active/standby mode.I have configured span session on both vPC peers with span source as VLAN 10 in rx mode.Span destination is connected to secondary vPC peer. The issue here is that I am not able to capture the traffic originating from HOST A destined to HOST B which is traversing vPC peer-link.Same issue occurs for the traffic in reverse way and span destination on primary vPC peer. In a nutshell, any traffic which crosses vPC peer-link is not getting captured.
What could be the issue and is there any solution for it. Below mentioned is the span config and relevant interfaces. [code]
View 4 Replies
View Related
Mar 28, 2013
We recently extended our access layer using a pair of 5ks with extenders. We have a pair of 6509s at our core and they handle the intra-VLAN routing with SVIs. I recently noticed that access hosts connected to the extenders cannot pass traffic between each other if they are in different VLANs. The strange thing is these same hosts can ping devices in other VLANs as long as the other devices are not connected to the 5k environment.
For example, consider the following hosts. Each host has their gateway set to the appropriate SVI on our core.
HostA - VLAN100 - connected to 5k extender
HostB - VLAN200 - connected to 5k extender
HostC - VLAN100 - connected to 2960 off our core
HostD - VLAN200 - connected to 2960 off our core
Each host can ping each other with the exception of HostA and HostB. As for specifics, we use HSRP (no VSS) between our cores.
When I ping between hostA and hostB, I see the egress packets on either 5k1 or 5k2. I then see ingress AND egress on Core1. There are no ingress packets on 5k1 or 5k2.The egress packets from Core1 show the correct destination MAC address of the target host. The mac address table shows the mac address on po31.
View 16 Replies
View Related
Oct 6, 2010
I'm having an issue with a Cisco 2811 ISR Router. Sh ver command output lists the correct ios that the router used for booting and it says that the ios is stored in flash but when i give "sh flash" command it doesn't display the ios file. Maybe the flash is corrupted or damaged in some way? In the attached file is the output from the "sh ver" and "sh flash" commands.
View 6 Replies
View Related
Nov 21, 2012
i'm going mad on following problem. I'm trying to get 2 networks seeing each other while one of the network is a non VLAN network and the other one is a VLAN network.They should use the same interface so i added VLAN e0/0.122 to the interface e0/0.Send a ping from my asa to both gw-IP's made me happy at first. In second in figured out that i cannot reach any client in the other network. For testing purpose i created an permit acl to any/any for both networks, but the packets still get dropped by the default implicit rule. (deny any/anyMaybe i'm to stupid for this
View 10 Replies
View Related
Feb 3, 2013
one of our switches (WS-C2960G-24TC-L). When I try to turn on the lanbase-routing feature using sdm prefer lanbase-routing, it gives me an error (Unknown command). I tried "sdm prefer ?", and lanbase-routing wasn't there (only qos, default and dual IPv4 & IPv6). The switch is running on image C2960-LANBASEK9-M version 12.2(50)SE5.We have another switch (WS-C2960S-24TS-L), running on image C2960S-UNIVERSALK9-M version 12.2(55)SE5, and I can enable lanbase-routing feature. If I upgrade the WS-C2960G-24TC-L to version 12.2(55)SE5, will it be able to do inter-vlan routing? Or is the switch itself totally limited to VLAN configuration only?
View 4 Replies
View Related
Jun 14, 2012
i have a cisco catalyst 2960g and for some reason out of the blue, some interfaces go down and then up. It started doing it after a power cycle.
View 1 Replies
View Related
Dec 30, 2011
I have 2960G that in rommon status.I need that the switch work in 0x2102 (regular mode).I don't have a backup to configutratuio in my PC.I do wr before the switch go to rommon (startup config).What to do in order to the switch will be in 0x2102 (regular mode) with the same configuration( before the switch go to rommon)?
View 1 Replies
View Related
Jun 26, 2012
I have a few 24-port Cisco 2960G Switches (model WS-C2960G-24TC-L) that I upgraded to IOS Release 15.0(1)SE2 using the web interface. I am now trying to upgrade those switches with the new release, 15.0(1)SE3, however I seem unable to do it, I have tried this on two switches so far, both have been upgraded to SE2 just a couple months ago or so, and both of them will not accept the SE3 upgrade, basically, I can select the tar file in the web browser and click "Upgrade" but when I do the status never changes from "Loading the tar file to the switch". I have tried multiple times from multiple computers using many different web browsers, including IE6 which is listed as supported. I have let it go for as long as 1.5 hours but to no avail.I also had a few idential switches here that had never been upgarded to SE2, I have had no problems loading SE3 onto them using the same method so it would seem that the tar file I have downloaded is valid.
View 5 Replies
View Related
Jun 7, 2012
I have a 2960G that I keep on the bench as a work switch. I assigned an IP address to it. The techs have had trouble imaging workstations using GHOST. Do any config changes need to be made to enable multicast to work? Everything is in VLAN1 at this point and the GHOST server is also the DHCP server.
View 1 Replies
View Related
Dec 20, 2011
I got problem with wake on LAN software.. The software unable to ON all pc's remotely if sitting under different vlan. Everything is ok if using the same vlan. Below are the network diagram & switch configuration.
Layer 3 switch Intervlan routing configuration
ip forward-protocol udp 7
!
interface Vlan4
description vlan Client-WOL
ip address 172.22.51.253 255.255.254.0
ip access-group Deny_HTTP_Vlan1 in
ip helper-address 172.20.1.246
[code].....
After configured all the switches with the above setting, the software still cannot wake all the pc's using LAN. Base on sniffing, i can't find UDP port usage by the software. Attached here with print screen from wireshark.
View 7 Replies
View Related
Jun 11, 2013
I recently changed jobs and at the new location we are primarily running Catalyst 2960G series switches with the exception of one 3750. All of the switches are setup in a cluster with the 3750 being the cluster master. My question is what is the benefit of switch clustering? The entire network seems to be a bit over engineered for the our needs and I am hoping to scale it back a bit. For example, the the network was setup with VOIP QoS when there were no plans to even use VOIP. Also what procedures would I want to follow to disable the cluster to avoid any major outages? Assuming there is no real need for a cluster.
View 1 Replies
View Related
Jun 7, 2012
I'm trying to decide what switch to use as a core for 500 users. I'm currently looking at either 2 x 3750X stacks or 2 x 4500s with dual SUPs and PSUs, both options will provide the number of switchports required without the need for additonal access layer swiches. Which switch option is best to go for here? All of our services will be located in our data centre which will be connected using 2 1000Mbps MPLS circuits. I wont need any advanced L3 features and we are not likley to scale over 450 users. Also is it ok to use the dual switch stacks or chassis to provide the collapsed core/access layer or is it best to have a dedicated core (using one of the above options with less switchports) and having a dedicated accesss layer using 2960Gs for example. Our structured cabling terminates in a single comms room so we wont need to distribute switches throughout the office.
View 3 Replies
View Related
Oct 23, 2012
i had made a software upgarde on the switch 2960G series have no any passwords, when I fished the upgrade process after rebooting the device i found it need a UserPw to access device manager. i tried to use the default PW "cisco" but it dosen't work too.. after that i tried the password recovery process to rest the PW, but noway, but now i have addition problem, when i try the cmd orders "flash_init , load_helper , dir flash" to beginning the password recovery process it shows the following:
The system has been interrupted prior to initializing theflash filesystem. The following commands will initializethe flash filesystem, and finish loading the operatingsystem software:
flash_init boot
switch: flash_initInitializing Flash...flashfs[0]: 554 files, 19 directoriesflashfs[0]: 0 orphaned files, 0 orphaned directoriesflashfs[0]: Total bytes: 32514048flashfs[0]: Bytes used: 15540224flashfs[0]: Bytes available: 16973824flashfs[0]: flashfs fsck took 10 seconds....done Initializing Flash.
switch: load_helperUnknown cmd: load_helper
switch: load_helperUnknown cmd: load_helper
switch: load_helperUnknown cmd: load_helper
[code]....
After that the problem updated
because I tried to install the IOS by Xmodem to reload the missing flash file.After finsh the TAR file loading and reboot the switch.......the LEDs of mode and Giga ports are lighted amber and not blinking, i tried many times to follow the steps to connect the switch by the emulator and consol cable by holding mode button and connecting the power cable at same time the device does not work, the switch now still not blinking, now i try to read and understand how can i remove the corrupted files and install a new IOS for this switch?What shall i do.
View 1 Replies
View Related
