• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

VLANs having same mac address causing flapping error on cisco switch

Scheduled Pinned Locked Moved L2/Switching/VLANs
34 Posts 4 Posters 8.0k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    JKnott @erasedhammer
    last edited by Mar 27, 2020, 1:54 AM

    @erasedhammer

    Well yeah, all VLANs from the same interface will have the same MAC. What is it you're trying to do?

    PfSense running on Qotom mini PC
    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
    UniFi AC-Lite access point

    I haven't lost my mind. It's around here...somewhere...

    1 Reply Last reply Reply Quote 0
    • D
      Derelict LAYER 8 Netgate
      last edited by Mar 27, 2020, 3:03 AM

      The MAC address table (CAM table) is segregated between VLANs (broadcast domains)

      It is absolutely not a problem to have the same MAC address from a device on different VLANs on the same properly-configured switch port.

      In fact, that's pretty much how the world works.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      J 1 Reply Last reply Mar 27, 2020, 3:24 AM Reply Quote 0
      • J
        JKnott @Derelict
        last edited by Mar 27, 2020, 3:24 AM

        @Derelict said in VLANs having same mac address causing flapping error on cisco switch:

        It is absolutely not a problem to have the same MAC address from a device on different VLANs on the same properly-configured switch port.

        The OP's post implies the switch thinks the MAC is on 2 different ports and that shouldn't happen, unless they're doing something strange.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • E
          erasedhammer
          last edited by erasedhammer Mar 27, 2020, 11:51 AM Mar 27, 2020, 11:51 AM

          What im trying to do is have each vlan on the fw have its own group of physical ports for lagg.
          I have the xg-7100 so it has that marvell integrated switch.
          If I run an ifconfig on the fw it shows all the vlans as having the same MAC (and every port on the marvell switch as having the same mac)
          Now if I have each vlan with its own channel group on the switch, and the switch sees the same MAC on every lagg group, it sends the flapping error message.

          I am not 100% whats happening in detail, but I do know when I went in and changed the mac addr for each vlan using ifconfig lladdr, the flapping errors stopped.

          J 1 Reply Last reply Mar 27, 2020, 12:57 PM Reply Quote 0
          • J
            JKnott @erasedhammer
            last edited by Mar 27, 2020, 12:57 PM

            @erasedhammer

            Perhaps you could provide a sketch, as I'm having a WTF? moment.

            How many ports are you using on pfSense for the VLANs? If only 1, then every VLAN that uses that interface will have same MAC. There's no way around that, as it's determined by the hardware. What comes after psSense?

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 0
            • N
              NogBadTheBad
              last edited by NogBadTheBad Mar 27, 2020, 1:09 PM Mar 27, 2020, 1:09 PM

              You generally see this type of issue in a HA setup, i've seen it many times with an all Cisco setup and HSRP.

              Are you running a HA pair, if you are there probably is a connectivity issue between the pair.

              Andy

              1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

              1 Reply Last reply Reply Quote 0
              • E
                erasedhammer
                last edited by Mar 27, 2020, 2:40 PM

                I am using 7 ports on the marvell switch on the xg7100 connected to my cisco 3560.
                eth2-3 are vlan 5
                eth4-6 are vlan 10
                eth7-8 are vlan 30

                I wanted to setup a lagg for each vlan, but since the xg7100 marvell switch does not support lacp, I had to throw everything to basic load balancing. I have the cisco ports set up within channel groups, and the pfsense ports I had to manually add them to their own lagg groups through ssh using etherswitchcfg.

                As far as I can tell, it works properly, on the switch it shows the proper ports per vlan have bundled.

                The 3560 will have the flapping error if I leave each vlan mac addr the same (as shown in ifconfig when run through ssh on the xg7100).

                I can draw something up later today to better illustrate.

                1 Reply Last reply Reply Quote 0
                • D
                  Derelict LAYER 8 Netgate
                  last edited by Mar 27, 2020, 4:03 PM

                  You should be setting up the load balance laggs using the web gui and changing the lagg numbers by clicking on the lagg number in Interfaces > Switches, Ports. Just use a unique number for each group.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • E
                    erasedhammer
                    last edited by Mar 27, 2020, 7:21 PM

                    I should be, but when I go to add a LAGG in the gui, the ports on the marvell switch do not show up. So I cannot make a LAGG with the ports I want to use.

                    1 Reply Last reply Reply Quote 0
                    • D
                      Derelict LAYER 8 Netgate
                      last edited by Mar 27, 2020, 7:27 PM

                      Screenshot please. That should not be the case. Unless maybe something you did under the hood is preventing that from working any longer somehow.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • E
                        erasedhammer
                        last edited by Mar 27, 2020, 7:37 PM

                        laggs.PNG

                        ix1 is only the 10gig sfp+.
                        Eth1-8 are not shown.

                        1 Reply Last reply Reply Quote 0
                        • D
                          Derelict LAYER 8 Netgate
                          last edited by Mar 27, 2020, 7:38 PM

                          No.

                          Interfaces > Switches, Ports

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • E
                            erasedhammer
                            last edited by Mar 27, 2020, 7:39 PM

                            If you are referring to inputting the lagg id manually there... that instantly destroys the web gui and requires the firewall to restart.

                            1 Reply Last reply Reply Quote 0
                            • D
                              Derelict LAYER 8 Netgate
                              last edited by Mar 27, 2020, 7:52 PM

                              Don't do it on a port you are trying to manage the firewall from. Same way you would not make a change to a switch port you are managing the switch from.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • E
                                erasedhammer
                                last edited by Mar 27, 2020, 7:59 PM

                                Sure, I understand that.

                                Referencing back to the original question, the xg7100 has the same MAC addr assigned to eth1-8 on the marvell switch, right?

                                So wouldnt creating separate LAGGs across that marvell switch cause a downstream switch to see the same mac for multiple channel groups, then cause the flapping error?

                                1 Reply Last reply Reply Quote 0
                                • D
                                  Derelict LAYER 8 Netgate
                                  last edited by Mar 27, 2020, 8:03 PM

                                  No. MAC Address tables should be separated in the switch by VLAN/broadcast domain.

                                  The MAC address being seen by the switch is actually the MAC address of the lagg0 created by ix2 and ix3 on the pfSense software on the uplink.

                                  Layer 2 switch ports do not have individual MAC addresses. The have MAC address tables and forward traffic between different MAC addresses in the same broadcast domain.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    erasedhammer
                                    last edited by Mar 27, 2020, 8:10 PM

                                    Okay, but the downstream switch has its own mac address table and when the vlans all show up as the same mac, I'm pretty sure that causes the flapping error.

                                    I'm not 100% sure what the flapping error exactly is, but I don't really see what else could cause the error since it stops when I change the macs for the vlans.

                                    J 1 Reply Last reply Mar 27, 2020, 8:24 PM Reply Quote 0
                                    • D
                                      Derelict LAYER 8 Netgate
                                      last edited by Mar 27, 2020, 8:24 PM

                                      Perhaps the load balance lagg/port channel in that switch is incompatible with the load-balance lagg in the Marvell chipset. Really hard to tell from here.

                                      The port channel should allow input from any MAC on any of the ports at any time.

                                      Are Po1 and Po2 in your OP members of the same port channel? Is the port channel properly-configured?

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        JKnott @erasedhammer
                                        last edited by Mar 27, 2020, 8:24 PM

                                        @erasedhammer

                                        Your original post showed the MAC as switching between interfaces. That wouldn't normally happen with VLANs.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        1 Reply Last reply Reply Quote 0
                                        • E
                                          erasedhammer
                                          last edited by Mar 27, 2020, 8:32 PM

                                          That's what Im trying to explain, that the switch thinks its switching because the vlans all show up as the same mac.

                                          My original post showed the switch saying it was switching, but if all the interfaces have the same mac, how would it know it was switching?

                                          J 1 Reply Last reply Mar 27, 2020, 9:29 PM Reply Quote 0
                                          21 out of 34
                                          • First post
                                            21/34
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received