Re: Etherchannel misconfig guard

Steve Shaw wrote:
> If you have the system-id extensions disabled, it is 75 different MACs
> in BPDUs that will throw the port-channel interfaces into
> error-disabled. If you have system-id extensions enabled, it is 75
> different system-ids in BPDUs that will trigger it.
> For example:
>
> test#show spanning-tree active detail | in received
> BPDU: sent 76, received 77
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 76, received 77
> BPDU: sent 1, received 75
> BPDU: sent 76, received 77
> BPDU: sent 76, received 77
> BPDU: sent 76, received 77
> BPDU: sent 76, received 77
> BPDU: sent 76, received 77
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> BPDU: sent 1, received 75
> test#
> *Mar 1 00:26:59.747: %PM-4-ERR_DISABLE: channel-misconfig error
> detected on Gi1/0/1, putting Gi1/0/1 in err-disable state
>
> This was tested on 3750s w/ system-id extensions enabled.
>
> Here is a brief overview of how a local switch will treat a
> misconfigured link on the opposite end:
>
> *Unconditional *- allows a misconfigured far-end link to join the
> port-channel
> *PAgP enabled* - does not allow misconfigured far-end link to join
> port-channel and treats as a seperate link. Spanning-tree will then block.
> *LACP enabled* - does not allow misconfigured far-end link to join
> port-channel and places in suspended mode.
>
> -Steve
> On Mon, Nov 23, 2009 at 10:38 AM, Dimitar Mojsovski
> <dimitar.mojsovski_at_gmail.com <mailto:dimitar.mojsovski_at_gmail.com>> wrote:
>
> Steve Shaw wrote:
>
> Here's an older doc for CatOS but the same scenario and
> behavior still applies to IOS:
> http://www.cisco.com/en/US/tech/tk389/tk213/technologies_tech_note09186a008009448d.shtml
>
>
> On Mon, Nov 23, 2009 at 8:44 AM, Dimitar Mojsovski
> <dimitar.mojsovski_at_gmail.com
> <mailto:dimitar.mojsovski_at_gmail.com>
> <mailto:dimitar.mojsovski_at_gmail.com
> <mailto:dimitar.mojsovski_at_gmail.com>>> wrote:
>
> Syed Moazzam Daimi wrote:
>
> Hi Dimitar,
> Etherchannel mis-config guard works only for
> Etherchannel configured in ON mode as you are forcefully
> configuring
> etherchannel in ON mode.
>
> If there is any misconfig like below, etherchannel protocol
> would take care of the port from participating in channel.
> SW1 (3 ports)
> ======etherchannel
> ON mode=======(2ports)SW2
> (stp root) Ideally its a
> mis-config on SW2 as only 2 ports are in the etherchannel
> instead of 3 ports. If you have configured STP Etherchannel
> misconfig guard, which would detect and see the STP bpdu's
> from SW1 to SW2 seen on channel/non-channel ports and
> would
> put the ports into error-disabled state to avoid any
> misconfigs.
> Also see,
>
> http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/stp_enha.html#wp1020683
> HTH
> Syed Moazzam Daimi
> CCIE # 22100
>
> I think I get it now :-)
> Thanks for your explanations !
>
>
>
> Blogs and organic groups at http://www.ccie.net
> <http://www.ccie.net/> <http://www.ccie.net/>
>
>
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
>
>
>
>
>
>
>
> Hi Steve,
>
> What you sent is a very interesting reading.
> It's actualy describing exactly what I am trying to do. Switch A
> not channeling and Switch B channeling.
> From what it says, 75 BPDUs from different MAC addresses in 30sec
> should trigger the detection and send it to err-disable ?
>
>
Steve,
thank you for explaining, and sorry for my late reply

Blogs and organic groups at http://www.ccie.net
Received on Fri Nov 27 2009 - 11:46:04 ART