One of our Cisco 3750G switches keeps showing this warning:
Description: Gi4/0/43: Unexpected BPDU received. Port has been Disabled.
Recommendation: Check Configuration of the switch, also make sure devices connected to the switch. Enable this port again.
However, there is no thing connecting to the port Gi4/0/43 as shown this link: [URL]. Why do you get this warning?
I obtain this message on Nexus 7000:2011 Dec 22 03:37:53 NNN %STP-2-RECV_BAD_TLV: Received SSTP BPDU with bad TLV on port-channel1 VLAN0020 and following with err-disabled port ?[URL]
View 3 Replies View RelatedI was wondering what could cause this, because every time this message shows up in the log I lose internet connection for about 1 minute then it comes back up. Let me know if I need to get any config info.
View 8 Replies View RelatedWe have an environment where users create a lot of bridge loops. We have tried to send E-mails about it and educate the users but it is almost a lost cause at this point. The loops are created when users don’t pay attention and they plug a patch cable coming off of an access port up to ANOTHER access port by mistake.
All of our access ports are from 3750 stacked switches. The way we tried to deal with this in the beginning was with BPDUGuard and ERRDiable (BPDUGuard) auto recovery. We turned BPDUGuard on globally and left BPDUGuard auto recovery at the default value (I believe it was 30 seconds). so a loop would be detected and after 30 seconds, the switch would try to enable the port and if the loop still existed, close the port for 30 more seconds. Then we started having problems with printers getting "fried". Their NICs would die out and the control board would need to be replaced. After a lot of troubleshooting and testing, it was determined that allowing the ports to come out of ERRDisabled state would flood the network and the packets would generate in the millions per second range and fry the NIC of these printer.
The fix for this and saving the printers was terrible. We removed ERRDisable auto recovery and just let the ports that are looped stay in an ERRRDisabled state. We wait for the user to figure out the loop and try to use the port and then put in a work order. Then we physically visit the site and verify the port was shut (ERRDisabled) from a loop and we bounce the port (shut/no shut) and everything is resolved. I did lab tests with a switch looped and a printer on the switch and watched it fry. We have had no printers fry after we removed the auto recovery protocol at every location. Only the locations where loops existed and auto recovery protocol running were printers going bad. What I found during my lab tests was that each time the port was auto-recovered (yes, for that millisecond while it checks if a loop still exists), more packets were re-generated and eventually enough was re-broadcastthat printers would go down. We never had a problem with computer NICs. I guess the cheaper printer NICs couldn’t handle the broadcast storms created by this. I tried playing with the auto recovery timers and even the highest setting would eventually re-create these storms.
So my question is what best practices are others using? Should we get rid of BPDUGuard and just try to let spanning-tree handle these bridge loops? Is there something else I can try? I’m not CCNA by any means, just trying to do what I can in my environment. Manually visiting sites when loops occur is becoming more and more my job, though and I have plenty of other things to be doing.
Currently it seems as our 3550's doesn't send traps when bpdu-guard sets a port in err-disable state. Or DFM doesnt recognize it.Is there a way to get a DFM alert when a 3550-port gets into err-disable state?
View 2 Replies View Relatedi have several cisco 6500 switches, and user switched connected to them.in my example i have a global service vlan, where some access ports are directly connected on the 6500, and this vlan is also allowed on the trunks to the access switch.
now i am connected with ma laptop on a access switch, where my port is in the same vlan. when i do a show mac address-table on my access port, i can see my own mac-address, nothing else.when i start wireshark to see the traffic, all i should see is traffic from or to my MAC, or broadcasts/multicasts.
But i can see other unicast traffic with different source/destination mac than mine.It seem slike these packets get broadcasted over the whole VLAN, but its no broadcast MAC nor IP.
So I took a laptop with wireshark and plugged it into a nexus 5000 port that is configured as a trunk with 3 vlans allowed on it. The laptop was seeing all kinds of traffic on the wire, most of it was not involving my laptop.
For example: Server A VLAN 10= 10.10.10.1 Server B VLAN 20= 10.20.20.1 and wireshark laptop is plugged into a trunk port which is allowing those vlan's. The vlan's are routable.
10.10.10.3 is seeing the entire conversation when 10.10.10.1 backs up 10.20.20.1 even though it has no reason to see it. It is as if the trunk is spanning traffic to the laptop port. No span is setup however. It's really weird. This is not just broadcast traffic, but actual tcp taffic between Server A and B. Why would a trunk port see traffic between 2 other servers talking to each other on the vlan.
Trunk port configuration below:
Interface Ethernet 141/1/3
switchport mode trunk
switchport trunk allowed vlan 10, 20
We have a stack of switches that is at the max number of members allowed in the stack. Problem is we are running out of port density and need to add more ports. So instead of adding a whole new stack I would rather replace 2 of the 24-port swicthes with 48-port switches.
If the two 24-port swicthes we are removing are stack members and neither of them are the stack master, I should be able to replace the 24-port switches with the 48-port switches without bringing the master offline? If the new 48-port switches are running the same IOS version as the current 24-port swicthes, they should add themselves to the stack?Would I have to tell the new 48-port swicthes what switch numbers they are replacing in order for them to be added to the stack since we are at the max number of members?Also since the 48-port swicthes are replacing 24-port switches will the master give the 48-port switches the configuration for only the 24-ports?
I am using 3660 Router, all cards are working fine as expected but NM-2FE2W is booted & then down. Following error is occurred in show diag "Port adapter is disabled deactivated".I have reset the card as well as router, changed the slot of card, but the problem is not resolved.
View 8 Replies View RelatedI have an SG-200-8 which connects to a stacked pair of SG500-28P switches. It is powered by PoE from the SG500. From the SG500 the port appears Up, but at the the SG200 it is disabled and nothing I do re-enables it. I know the cable is good because I had a previous netgear switch hanging off it and working, also the power gets through.I can only connect to the switch if I disable wifi and plugin a manually configured PC - DHCP doesn't get through to it from the SG500 end.I have tried a second SG200 same problem. Have disabled RSTP/ STP thinking it might to relate to the fact that a PC connected to the switch also had a wifi connection to the same LAN, but. Don't know where to go next. looks like a bug?
View 1 Replies View RelatedI have a wap200 wireless access point configured and connected to the switch 2690 switch on vlan1, when I connect the wireless access points to the switch the port become disabled.
View 1 Replies View RelatedI've got a pair of N7010's in a vPC domain with some FEX's attach running NX-OS 6.0.2. I am experiencing port failures on my N7K-M132XP-12L module the port got shut down due to internal errors with Error Disabled status and I am not able to bring the port back up. I am getting the following errors when I try to reset it. I am hoping is not hardware related as my vPC peer-link is on this module and I only have a single N7K-M1 32 XP-12L in each N7010. Replacing the module will be painful. [code]
View 7 Replies View RelatedI am having a problem getting serial interfaces to show up with a NM4A/S card in a 3745 router. It worked at first but now the serial interfaces don't show up in running-config but show diag shows the card is present but says "Port adapter is disabled deactivated". I have tried the card in 3 different slots and of course turned off power when moving card around (left power cord in for grounding). Again, it was once working (serial interfaces were showing up in running-config) so if I damaged the slot somehow, however I was very careful when seating card. Have been searching the learning network and google for days now to no avail. Have tried to find something similar to the card type command thinking the port adapter needs to be activated but have not found any documentation about that. Hope card isn't bad all of a sudden but really don't think it is since it worked before and it seems to be recognized just not showing serial interfaces in running-config/sh ip int b (on ios/cli). Really think it's something along the lines of activating card, but not sure.
View 1 Replies View RelatedI've got two two 3560s switchs, (WS-C3560G-48TS-S) that I'm trying to connect to each other using the GB ports over Fibre. We purchased the following GBICs, SFP 1000SX Transceiver and when we put them in the port it shows (err-disabled). Below is some information I pulled from one of the ports, but doesn't matter what port I use they all say the same thing.
ProdSwitchSW1#show run int g0/51
Building configuration...
Current configuration : 37 bytes
!
interface GigabitEthernet0/51
end
[code]....
Configuration register is 0xF
Using a Mac running Mac OS X 10.6.8 with VPN Tracker 6.3.0.Before switching to the WAG320N I had no issues with my IPSEC VPN client. After the switch it consistently fails in Phase 1 negotiation.In the log file of the gateway I only notice: Mon, 2011-08-22 07:47:31 - [Outgoing] UDP Packet - 192.168.1.100:500 --> IP.ADDRESS.VPN.GATEWAY:500.The software itself complains about timeouts while contacting the remote gateway.VPN pass through is enabled, no port forwarding is set up, firewall is disabled.
View 6 Replies View RelatedAs the subject says, I've hooked up a Samsung BD player to a BEFSR41 router. The router has the current firmware version. When I run the connection test for the player, the local connection is good but the Internet connection fails and the message is " The HTTP port is disabled."
I've searched high and low for a solution to no avail. I did searches on the forum and couldn't find anything. As a test, I connected the BD player directly to the DSL modem and the Internet connection worked perfectly so it appears that the blockage is within the router.
I've serched through the router setup and have changed most settings to try and find something that would work. Nothing worked so I have returned my setup to its original state.
We currently have two 5548UP and two 2232PP switches running on 5.1(3)N2(1a) and the plan is to connect our old 3560G switches to 2232 PP using enhanced Vpc.
I enabled spanning tree bpdufilter on the 2232 PP ports so that we can connect switches to them but VTP is not working on those ports. Is there anything that needs to be done on the HIFs for VTP to work.Does VTP depends on BPDUs? Does enabling Bpdufilter affects VTP?
I am getting this error on our Cisco 5500 switch. What it means
2012 Sep 13 14:49:37 PDT -07:00 %SPANTREE-2-RX_1QNONTRUNK: Rcved 1Q-BPDU on non-trunk port 3/20 vlan 72
2012 Sep 13 14:49:37 PDT -07:00 %SPANTREE-2-RX_1QPVIDERR: Rcved pvid_inc BPDU on 1Q port 3/20 vlan 72
2012 Sep 13 14:49:37 PDT -07:00 %SPANTREE-2-RX_BLKPORTPVID: Block 3/20 on rcving vlan 72 for inc peer vlan 235
2012 Sep 13 14:49:37 PDT -07:00 %SPANTREE-2-PORTUNBLK: Unblock previously inc port 3/20 on VLAN 72
I am testing BPDU filter with 3560 model switch so I've looped 2 interfaces in that switch by configuring STP BPDU filter on interface levels and also connected one desktop in other interface on same vlan of looped interfaces with bpdufilter config. I am facing is both the looped interfaces are having heavy traffic due to this my switch CPU utilization also reached high. How to sort out this issue like why my switch interfaces traffic & CPU utilization went high even when I am using BPDU filter at interface level? As well as correct my BPDU configuration If I configured wrong. I thought it is a good practice and enabled this conf in some of my working environment but due to some loop my entire network went down?
View 6 Replies View RelatedI have an issue with an ASR 1001. The problem occurs with MQC shaping applied to a gigabit interface in the outbound direction. The CIR of the provider we are using is 100Mb/sec, so we are shaping to that value. However when reported traffic levels are about 60Mb/sec, we see a steady increase in output drops. [code]
I have also tried increasing the hold queue, however this does not work with the drops. Increasing the shaping rate to 200Mb/sec gets rid of almost all the drops (not quite all!) but is not what we need. I think that we should see some drops when rates spike above 100mb, however the amount we are seeing seems excessive?
On one of my computer i'm having multiple issues. when I am on most websites it pops up " TypeError: object unexpected" or just "object unexpected" and I have to refresh the page for them to go away, but if I hit the back button or go to another section of the web page they pop back up. The same computer is now having connection issues and only has "unidentified network no internet access" as the only option, and after everything I have tried it will not budge on the wifi.
View 1 Replies View RelatedIn last days I'm having problems with a Cisco 1812 device. It works for some time but then crashes and gives the same info.
View 6 Replies View RelatedI have a number of WLCs/WiSM2 running 7.0.230.0 (still using WCS for management). The management interfaces for the controllers are on a purely private subnet. While going through the intenet edge ASA logs I noticed some traffic drops for the controllers on the Inside interface. I took a packet capture from the controllers and found that they were sending TCP traffic to a number of IP addresses (Microsoft, Hotmail and Google) - always with a src port 2028 (submitserver) with the ACK/FIN flags set. Why this traffic is coming from the management interfaces? The management interface is not used by any wireless clients and is not the default interface for any of the SSIDs.
View 4 Replies View RelatedI have a number of WLCs/WiSM2 running 7.0.230.0 (still using WCS for management). The management interfaces for the controllers are on a purely private subnet. While going through the intenet edge ASA logs I noticed some traffic drops for the controllers on the Inside interface. I took a packet capture from the controllers and found that they were sending TCP traffic to a number of IP addresses (Microsoft, Hotmail and Google) - always with a src port 2028 (submitserver) with the ACK/FIN flags set.
View 2 Replies View RelatedWe have a lab network set up with a 7609 router as the central core. Scenario: Laptop with a SIP client. In the lab is a session border controller that will route signaling and media to a SIP gateway with a call agent (172.23.112.201) and a media "handler" (172.23.113.6). The call processing device will forward packets to an RF network (108.x.x.x) where an NCS cable modem sits.Call signaling works perfectly fine. However, RTP traffic from the laptop to the NCS phone is getting routed incorrectly. RTP traffic from the phone to the laptop works fine. [code]
Packet captures show the laptop to phone RTP packets are being routed back towards the corporate router. These time out with ICMP TTL exceeded packets. There are static routes for 172.23.113.0/27 to the optical interfaces that go to the SIP gateway. Interestingly, I can ping an IP on the SIP gateway (not used for media, but is pingable) in that static range (172.23.113.1) just fine from the 7609 (i.e. it's not getting routed to the corporate router). Unfortunately, the IP for the media endpoint on the SIP gateway is not pingable. Config for the 7609 is attached.
I use a CISCO ASA 5505 with ASA 8.3. Everything works fine, but when I type the following line I get an error message:
nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5ERROR: 10.1.5.5 doesn't match an existing object or object-groupI even tried to create the missing object but it did not work. The document also explains how to use ASDM for this configuration. It seems that there an object 10.1.5.5. is created.
This is the output of "show running-config":
ASA Version 8.3(1) !hostname ciscoasaenable password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Vlan1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 !interface Vlan2 nameif outside security-level 0 ip address 10.1.5.1 255.255.255.0 !interface Ethernet0/0 switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2! interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!ftp mode passiveobject network obj_any subnet 0.0.0.0 0.0.0.0object network
[code]....
One of our ASA5510s lost VPN site-to-site connectivity (ASA v8.2(2); ASDM v6.2(5)53) to one of our other sites last night. The checkbox for Access Interfaces on the Site-to-Site area in Connection Profiles lost its checkbox for the external interface.
View 1 Replies View RelatedLast night, the C6509-E do a unexpected reload. In the crashinfo, I can see that the last error message before the reload, was as follows: %C6K_ PLATFORM-SP-2-PEER_RESET: SP is being reset by the RP
I consulted the cisco website about this error message and what I found was the following:C6K_PLATFORM-2.
I have a weird situation with some switches.
Switch .55 can ssh into Switch .57 but cannot ssh into Switch .56.
Switch 56 can ssh into Switch 55 and ssh into Switch 57
Switch 57 can ssh into Switch 55 and ssh into Switch 56
The software on .56 is:
C3560 Software (C3560-IPBASEK9-M), Version 12.2(55)SE3, RELEASE SOFTWARE (fc1)
I noticed on .56, when I do a show ip ssh I get: SSH Enabled - version 1.5. It doesn't say version 1.99 like the others even when I configure version 2. Is this a bug I am running into?
I have problem with RV120W router, device reboots very often ( up to 3-4 times during working day ), firmware is up to date ( 1.0.4.10 ), last week I decided to use "restore the factory defaults" unfortunately problem still exists.
Router is working in small office, there are 3 PC and 3 VOIP phones ( connected via LAN ) and 1-2 devices connected via wireless ( smartphones )
I've tried to view some logs but unfortunately no luck, can see some errors/warnings in dashboard ( see attached picture ) but cannot see more details ( log configuration wrong ? )
Additionally sometime I can see that CPU utilization is 100%
erro came with 3722------however after checking date and time i was able to login. AZAD
View 1 Replies View RelatedOn my network I have a Netgear ReadNAS connected and I'm using an add-in (ReadyNAS Remote) that simplifies the log in to for both internet and LAN-users. However, I get a lot of the following entries in the log when that add-in is being used.
When an internet user log in via ReadyNAS Remote: "Blocked outgoing TCP packet from 192.168.0.xxx:3649 to xx.xxx.xxx.xxx:50125 with unexpected acknowledgement 3320366884 (expected 754541166 to 755655246)"
When a LAN-user log in via ReadyNAS Remote: "Blocked incoming TCP packet from 69.xxx.xxx.xx:80 to xx.xx.xx.xxx:50329 with unexpected sequence 3004123085 (expected 3004136875 to 3004393915)"
how to prevent them from occuring?
I'm trying to block access to dropbox.com on our ASA5510. I have it setup and it blocks dropbox.com just fine. But it is also blocking google.com. I can't figure out why.
Here's my config. When it blocks google, it blocks it with the terminated by inspection engine, reason - disconnected, dropped packet.
regex Block_Dropbox ".dropbox.com"
access-list URL_Filtering extended permit tcp any any eq www
access-list URL_Filtering extended permit tcp any any eq https
[Code]......