3

I am having trouble wrapping my brain around a VRF concept and why two switches are communicating with each other on a particular VLAN when I don't think they should.

switch1 & switch2 are independent core switches with a port channel between them. However, none of the VLANs that are configured with SVIs in the VRF are configured on the port channel.

I have vlan 920 (L2) configured on switch1 and switch2. I also have SVI vlan920 (L3) configured on both switches. The SVI vlan920 is configured inside VRF extwan as are several others.

vlan920 on switch1 is 10.146.64.130 & 10.146.64.131 on switch2.

If I issue a 'ping vrf extwan 10.146.64.131' on switch1, I get a reply.

If I do a 'sh ip arp vrf extwan' on switch1 there's an entry pointing .131 to vlan920 & a MAC address on switch2 that is the same for every SVI on that switch. I assume it represents the MSFC.

So, there is no physical L3 connection set up yet between the switches and the existing L2 channel does not include these VLANs, how am I getting ARP entries in the VRF for the other switch?

The VRF is connected to a set of ASAs on another SVI (also in the VRF) so maybe it's going through that?

Another possibility is that these switches are connected to access switches but STP is blocking one of the links on each VLAN.

Simplified/Sanitized Diagram

  • 1
    In order to give you an answer, we need to see configs of all the devices. Also a simple diagram would be helpful. – Ron Trunk Jul 29 '16 at 18:46
  • Do you have a VLAN list configured on the port-channel which excludes VLAN 920, or do you have no VLANs at all defined on the port-channel? – Karl Billington Jul 29 '16 at 19:20
  • Added a diagram. Trying to shorten and sanitize the configs will be a little more involved. @Qualeboy, VLANs are configured on the port channel but not the ones with SVIs in the VRF. I added that part to the diagram as well. – RSS Jul 29 '16 at 19:54
  • So your ARP table on switch 1 has an entry for switch 2's vlan 920 interface 10.146.46.131? What does the MAC address table show for that MAC address on switch 1? Is there an entry for VLAN 920? – Karl Billington Jul 29 '16 at 20:51
  • 1
    I'm talking about the MAC address table, not ARP, so show MAC address-table, that will show you the port that the MAC address is being learned on and will indicate if it's being learned on another interface – Karl Billington Jul 29 '16 at 22:44
1

At first I thought this might be working as designed or some artifact of L2 communication I didn't understand. However, I did some deeper digging and found another path between switch1 and switch2 on vlan 920...

I found that switch1 was learning switch2's SVI MAC address for vlan 920 through another port channel which led to one of the access switches.

I took a look at this access switch and for reasons I don't yet understand, it has STP turned off (no spanning-tree vlan 550, 920, 930, 940) for the VLANs I added for this project. I think this happened automatically as VTP is enabled on this network and the config changed on the same day the vlan.dat file changed.

So communication on VAN 920 is going from switch1, to this access switch and then switch2 because STP isn't being blocked on either of the port channels to the access switch.

I'll close this question out and will probably post a new question on how this would happen. I haven't found the answer via google yet.

| improve this answer | |
  • Checking the MAC address table would show you this. The MAC address table (not ARP table) shows you which interface a MAC address is being learned on, so lets you know the L2 path to the MAC address. I think you are misunderstanding STP. If VLAN 920 is only enabled on the links to the access switch and there are no other L2 paths (i.e. it's not enabled on Po50 or any other interconnect between switch 1 and switch 2) then that link would forward even if STP was enabled. STP only blocks when there is a looped topology. – Karl Billington Jul 29 '16 at 22:53
  • Yes, I'd checked the MAC address table before but since the same MAC was showing up for all the SVIs I didn't notice the fact that VLAN 920 was coming from a particular port. When I did a sh mac-address table vlan 920, it became clear. You're right in that if I open the port channel between the switches & ensure that STP is enabled on that VLAN then it should block that second path. – RSS Aug 1 '16 at 15:27
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer. – Ron Maupin Jul 25 '17 at 14:09
  • @RSS please accept your own answer. :-) – user36472 Feb 20 '18 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.