Re: Etherchannel misconfig guard

If you have the system-id extensions disabled, it is 75 different MACs in
BPDUs that will throw the port-channel interfaces into error-disabled. If
you have system-id extensions enabled, it is 75 different system-ids in
BPDUs that will trigger it.
For example:

test#show spanning-tree active detail | in received
   BPDU: sent 76, received 77
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 76, received 77
   BPDU: sent 1, received 75
   BPDU: sent 76, received 77
   BPDU: sent 76, received 77
   BPDU: sent 76, received 77
   BPDU: sent 76, received 77
   BPDU: sent 76, received 77
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
   BPDU: sent 1, received 75
test#
*Mar 1 00:26:59.747: %PM-4-ERR_DISABLE: channel-misconfig error detected on
Gi1/0/1, putting Gi1/0/1 in err-disable state

This was tested on 3750s w/ system-id extensions enabled.

Here is a brief overview of how a local switch will treat a misconfigured
link on the opposite end:

*Unconditional *- allows a misconfigured far-end link to join the
port-channel
*PAgP enabled* - does not allow misconfigured far-end link to join
port-channel and treats as a seperate link. Spanning-tree will then block.
*LACP enabled* - does not allow misconfigured far-end link to join
port-channel and places in suspended mode.

-Steve
On Mon, Nov 23, 2009 at 10:38 AM, Dimitar Mojsovski <
dimitar.mojsovski_at_gmail.com> wrote:

> Steve Shaw wrote:
>
>> Here's an older doc for CatOS but the same scenario and behavior still
>> applies to IOS:
>>
>> http://www.cisco.com/en/US/tech/tk389/tk213/technologies_tech_note09186a008009448d.shtml
>>
>>
>> On Mon, Nov 23, 2009 at 8:44 AM, Dimitar Mojsovski <
>> dimitar.mojsovski_at_gmail.com <mailto:dimitar.mojsovski_at_gmail.com>> wrote:
>>
>> Syed Moazzam Daimi wrote:
>>
>> Hi Dimitar,
>> Etherchannel mis-config guard works only for
>> Etherchannel configured in ON mode as you are forcefully
>> configuring
>> etherchannel in ON mode.
>>
>> If there is any misconfig like below, etherchannel protocol
>> would take care of the port from participating in channel.
>> SW1 (3 ports) ======etherchannel
>> ON mode=======(2ports)SW2
>> (stp root) Ideally its a
>> mis-config on SW2 as only 2 ports are in the etherchannel
>> instead of 3 ports. If you have configured STP Etherchannel
>> misconfig guard, which would detect and see the STP bpdu's
>> from SW1 to SW2 seen on channel/non-channel ports and would
>> put the ports into error-disabled state to avoid any misconfigs.
>> Also see,
>>
>> http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/stp_enha.html#wp1020683
>> HTH
>> Syed Moazzam Daimi
>> CCIE # 22100
>>
>> I think I get it now :-)
>> Thanks for your explanations !
>>
>>
>>
>> Blogs and organic groups at http://www.ccie.net <http://www.ccie.net/>
>>
>>
>>
>> _______________________________________________________________________
>> Subscription information may be found at:
>> http://www.groupstudy.com/list/CCIELab.html
>>
>>
>>
>>
>>
>>
>>
>>
>> Hi Steve,
>
> What you sent is a very interesting reading.
> It's actualy describing exactly what I am trying to do. Switch A not
> channeling and Switch B channeling.
> From what it says, 75 BPDUs from different MAC addresses in 30sec should
> trigger the detection and send it to err-disable ?

Blogs and organic groups at http://www.ccie.net
Received on Mon Nov 23 2009 - 12:55:28 ART