Hi everybody,
recently we saw a strange bahviour in our network. A customer with a
Proxmox server had a Windows 2k8 VM with 2 virtual NICs (both bridged to
eth0 of the server which faces the internet) and bridged them together
INSIDE the VM. This caused immediately high latency and partial
packet-loss within the whole network with the following messages in the
router log:
May 29 04:06:33 cr0 l2ald[2545]: L2ALD_MAC_MOVE_NOTIFICATION: MAC Moves
detected in the system
This is all I saw, no other device detected anything suspicious. This is
the setup of the network:
MX480 router with DPCE and irb-interfaces but no (R)STP or any other STP
flavour. This router connects 2x 10G as ae0 to a virtual-chassis
consisting of 2x EX4550. This is a pure Layer2 device and the RSTP root
bridge with priority 0. Furthermore, each server room is equipped with
2x EX4200 in a VC as well with a RSTP priority of 16k. The ToR switches
might have RSTP enabled or not and are usually connected with 1x GE to
the EX4200 stack. Here is a scheme which describes the setup hopefully
good enough:
+-------+
| MX480 | ------- L3 edge-router, no STP
+-------+
|| ------- ae0 with 2x XGE
+----------------+
| EX4550 | ------- L2 only
+----------------+ ------- RSTP priority 0
| EX4550 |
+----------------+
|| ||
+----------+ +----------+
| EX4200 | | EX4200 |
+----------+ +----------+ ------- RSTP priority 16k
| EX4200 | | EX4200 |
+----------+ +----------+
| | | ------- 1GE links to ToR
+-------+ +-------+ ...
| HP SW | | HP SW | ------- RSTP priority 32k
+-------+ +-------+
|||||||
|...
+--------------+
| Proxmox Host |
+--------------+
In this particular scenario, the HP ProCurve switch had STP disabled and
did not participate in the spanning-tree protocol. However, for my
understanding that shouldn't be required anyways because the VC of the
EX4200 switches should identify a potential loop on their own as long as
there is no BPDU filter present.
The visible behaviour was high latency to several devices and sometimes
up to 100% packet-loss. Not only within the customer's vlan but globally
in every L2 segment. The arp count did not change on the router, I
checked that. No TC event was recognized by any device. The questions
are now:
- How is it possible that a bridge on a host with just ONE physical
uplink can cause such problems?
- Am I correct that RSTP on the ToR switches is not required as long as
they do not filter BPDUs?
- Why would the MX router create such a message and indicate, that the
MAC changes although there is only one interface (ae0) facing the L2
network? Even if a MAC moves on the EX4550 stack from one port to
another, the MX would never see that.
Please let me know if you need any further details. I am very curious to
find out what went wrong here. Do I have a misunderstanding on how STP
behaves in that scenario? Are there any ways to dig deeper into analysis
of the causes for that strange MX log message?
Thanks a lot!
Best regards,
Jeff
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
