2

Is there a way to detect unmanaged switches that are connected on access ports?

In a spanning tree trunking managed network I look at bpdu errors on ports which usually indicate an unmanaged switch as a PC should not sent these.

I also look at logs that indicate that a switch is running low on resources as a loops can overload the CPU if it's not detected.

Do you know of any other or better ways?

I am primarily interested in solutions that work with Cisco and Juniper but a vendor agnostic approach would be also welcome.

I am asking as access ports use two vlans (data and voice) and any frames sent through unmanaged switches lose the voice vlan tag which causes problems with the phones.

7

Preventing Unmanaged Switches and Loops:

The best solution would be to block unmanaged switches entirely, except those that you explicitly allow. This can be done by enabling bpduguard on access ports, which would disable any port that receives a bpdu packet.

Example:

CISCO: Switch(config-if)#spanning-tree bpduguard enable
JUNIPER: user@switch# set ethernet-switching-options bpdu-block interface ge-0/0/0.0 shutdown

If there are unmanaged switches on your network that you would like to keep but protect STP and prevent loops you could enable a feature called root guard. This would allow that port to still receive bpdu packets, but it would not forward those that try to alter STP.

Example:

CISCO: Switch(config-if)# spanning-tree guard root
JUNIPER: user@switch# set protocols rstp interface ge-0/0/7 no-root-port

Limit the number of MAC addresses or whitelist MAC addresses on switch ports.

Example:

CISCO: switch(config-if)# switchport port-security maximum 2
     Switch(config-if)# switchport port-security mac-address 0000.000.000.0000

JUNIPER: user@switch# set interface ge-0/0/1 mac-limit 10
user@switch# set interface ge–0/0/2 allowed-mac 00:00:00:00:00:00

Detecting Unmanaged Switches:

Method 1: View the MAC address table, if you see multiple machines connecting on a single port, that is a pretty good indication that their is a switch connected to that port.

Method 2: Look for ports running STP

Example:

Switch# show spanning-tree vlan 1-4094 | inc STP

Method 3: Using Cisco Debug to see which ports are receiving bpdu's

Example:

CISCO: Switch# debug spanning-tree bpdu receive
JUNIPER: user@switch> show spanning-tree statistics interface
| improve this answer | |
3

Typically, an unmanaged switch wouldn't send BPDU's, since it won't support spanning-tree. So you can only see your own BPDU's coming back to you on another port then. If you're running spanning-tree, you can use a BPDU guard on Cisco to stop the loop by shutting down the interface:

interface GigabitEthernet0/1
  spanning-tree bpduguard enable

On Juniper:

set rstp bpdu-block-on-edge interface ge-0/0/0.0 edge

Another way to monitor and prevent them is by implementing storm control, which can help you to detect and stop broadcast, multicast and unknown unicast floods.

Both Cisco and Juniper support this. On Cisco, you can use:

interface GigabitEthernet0/1
  storm-control broadcast level 0.01

The level here indicates the percentage of the total interface bandwidth which can be used for broadcast/multicast/unknown unicast traffic. You can then set an action on what happens when this level is exceeded:

storm-control action shutdown

To shut the port. Or,

storm-control action trap

To send a SNMP trap (see below for more about this).

On Juniper you can use:

set ethernet-switching-options storm-control action-shutdown

On Juniper, the command is:

set ethernet-switching-options storm-control interface xe-0/0/0 bandwidth 1000

The rate is in Kbps.

If you want to be more proactive, you can consider configuring SNMP traps for spanning-tree and storm control events. Your switches can then send trap messages to a central SNMP trap server when a loop occurs.This SNMP trap server can then send you an alert (via mail, SMS, IRC, or whatever you have in place).

On Cisco you can configure SNMP traps like this:

snmp-server enable traps port-security

On Juniper:

set snmp trap-group GROUPNAME link
| improve this answer | |
  • Will managed switches send frames through access ports if the access port is connected to an access port of another managed switch instead of using uplink ports? – Marek Andreansky Aug 8 '16 at 8:09
  • Marek that would generally not be good from a design standpoint, however nothing would prevent you from being able to do so, as long as the access port and the connecting managed switch are in the same VLAN it will work. To prevent issues you should enable root guard and or set a spanning-tree cost to prevent that access port from becoming the root for a given VLAN. – Brian Winning Jr. Aug 8 '16 at 8:26
  • I agree that it would be bad, but I was asking if Cisco and Juniper devices are prohibited to use access ports unless the mac is directly connected on that port – Marek Andreansky Aug 8 '16 at 8:51
  • 2
    On Cisco switches, we globally set spanning-tree portfast default and spanning-tree portfast bpduguard default. This means you do not need to set this on individual access ports, except trunk ports, as it will not affect trunk ports unless you use the trunk keyword. You can override it on individual ports if you want. This will set a port to err-disable if BPDUs are detected on an access port. – Ron Maupin Aug 8 '16 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.