3

I am having trouble wrapping my brain around a VRF concept and why two switches are communicating with each other on a particular VLAN when I don't think they should.

switch1 & switch2 are independent core switches with a port channel between them. However, none of the VLANs that are configured with SVIs in the VRF are configured on the port channel.

I have vlan 920 (L2) configured on switch1 and switch2. I also have SVI vlan920 (L3) configured on both switches. The SVI vlan920 is configured inside VRF extwan as are several others.

vlan920 on switch1 is 10.146.64.130 & 10.146.64.131 on switch2.

If I issue a 'ping vrf extwan 10.146.64.131' on switch1, I get a reply.

If I do a 'sh ip arp vrf extwan' on switch1 there's an entry pointing .131 to vlan920 & a MAC address on switch2 that is the same for every SVI on that switch. I assume it represents the MSFC.

So, there is no physical L3 connection set up yet between the switches and the existing L2 channel does not include these VLANs, how am I getting ARP entries in the VRF for the other switch?

The VRF is connected to a set of ASAs on another SVI (also in the VRF) so maybe it's going through that?

Another possibility is that these switches are connected to access switches but STP is blocking one of the links on each VLAN.

Simplified/Sanitized Diagram

Improve this question
8
  • 1
    In order to give you an answer, we need to see configs of all the devices. Also a simple diagram would be helpful.
    – Ron Trunk
    Commented Jul 29, 2016 at 18:46
  • Do you have a VLAN list configured on the port-channel which excludes VLAN 920, or do you have no VLANs at all defined on the port-channel?
    – user27899
    Commented Jul 29, 2016 at 19:20
  • Added a diagram. Trying to shorten and sanitize the configs will be a little more involved. @Qualeboy, VLANs are configured on the port channel but not the ones with SVIs in the VRF. I added that part to the diagram as well.
    – RSS
    Commented Jul 29, 2016 at 19:54
  • So your ARP table on switch 1 has an entry for switch 2's vlan 920 interface 10.146.46.131? What does the MAC address table show for that MAC address on switch 1? Is there an entry for VLAN 920?
    – user27899
    Commented Jul 29, 2016 at 20:51
  • 1
    I'm talking about the MAC address table, not ARP, so show MAC address-table, that will show you the port that the MAC address is being learned on and will indicate if it's being learned on another interface
    – user27899
    Commented Jul 29, 2016 at 22:44

1 Answer 1

Reset to default
1

At first I thought this might be working as designed or some artifact of L2 communication I didn't understand. However, I did some deeper digging and found another path between switch1 and switch2 on vlan 920...

I found that switch1 was learning switch2's SVI MAC address for vlan 920 through another port channel which led to one of the access switches.

I took a look at this access switch and for reasons I don't yet understand, it has STP turned off (no spanning-tree vlan 550, 920, 930, 940) for the VLANs I added for this project. I think this happened automatically as VTP is enabled on this network and the config changed on the same day the vlan.dat file changed.

So communication on VAN 920 is going from switch1, to this access switch and then switch2 because STP isn't being blocked on either of the port channels to the access switch.

I'll close this question out and will probably post a new question on how this would happen. I haven't found the answer via google yet.

Improve this answer
2
  • Checking the MAC address table would show you this. The MAC address table (not ARP table) shows you which interface a MAC address is being learned on, so lets you know the L2 path to the MAC address. I think you are misunderstanding STP. If VLAN 920 is only enabled on the links to the access switch and there are no other L2 paths (i.e. it's not enabled on Po50 or any other interconnect between switch 1 and switch 2) then that link would forward even if STP was enabled. STP only blocks when there is a looped topology.
    – user27899
    Commented Jul 29, 2016 at 22:53
  • Yes, I'd checked the MAC address table before but since the same MAC was showing up for all the SVIs I didn't notice the fact that VLAN 920 was coming from a particular port. When I did a sh mac-address table vlan 920, it became clear. You're right in that if I open the port channel between the switches & ensure that STP is enabled on that VLAN then it should block that second path.
    – RSS
    Commented Aug 1, 2016 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.