How to disable ICMP type 9 (router advertisement) on SG300

Question

Oddly enough our cisco SG300's are making "Router Announcements"/"Mobile IP Advertisements" (ICMP type 9) via IPv4 (not IPv6). They are sourced from the IP/MAC of the switch and destined for 224.0.0.1/0100.5e00.0001

root@ftp:~# tcpdump -ennvvs0 -i eth0 host 224.0.0.1
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:49:30.511878 34:62:88:74:35:7e > 01:00:5e:00:00:01, ethertype IPv4 (0x0800), length 60: (tos 0xe0, ttl 1, id 31447, offset 0, flags [none], proto ICMP (1), length 36)
    192.168.161.116 > 224.0.0.1: ICMP router advertisement lifetime 30:00 1: {192.168.161.116 0}, length 16
15:49:36.598195 dc:eb:94:75:69:1e > 01:00:5e:00:00:01, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 1, id 36901, offset 0, flags [none], proto ICMP (1), length 36)
    192.168.161.102 > 224.0.0.1: ICMP router advertisement lifetime 30:00 1: {192.168.161.102 0}, length 16
15:50:01.276335 88:f0:77:58:81:16 > 01:00:5e:00:00:01, ethertype IPv4 (0x0800), length 60: (tos 0xe0, ttl 1, id 43069, offset 0, flags [none], proto ICMP (1), length 36)
    192.168.161.101 > 224.0.0.1: ICMP router advertisement lifetime 30:00 1: {192.168.161.101 0}, length 16
^C
3 packets captured
3 packets received by filter
0 packets dropped by kernel

Most devices seem to ignore them; but some HP printers see them and changed their manually configured default gateway to point to the sender of the RA.

These switches do not provide any routes of note. How do I disable these announcements?

config:

sg10-1#sho run
config-file-header
sg10-1
v1.4.7.6 / R800_NIK_1_4_194_194
CLI v1.0
set system mode router 

file SSD indicator encrypted
@
ssd-control-start
ssd config
ssd file passphrase control unrestricted
no ssd file integrity control
ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
!
vlan database
vlan 100,110,161-162,666
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
hostname sg10-1
logging host 192.168.161.3
no passwords complexity enable
username foobar password encrypted **** privilege 15
ip ssh server
snmp-server location HydroLab
snmp-server community **** ro view Default
clock timezone " " 0 minutes 0
clock source sntp
!
interface vlan 1
 shutdown
!
interface vlan 100
 name offship
!
interface vlan 110
 name Telepresence
!
interface vlan 161
 name SSSG
 ip address 192.168.161.101 255.255.255.0
!
interface vlan 162
 name ALVIN
!
interface vlan 666
 name unused
 shutdown
!
interface gigabitethernet1
 switchport mode access
 switchport access vlan 162
!
interface gigabitethernet2
 switchport mode access
 switchport access vlan 162
!
interface gigabitethernet3
 switchport mode access
 switchport access vlan 162
!
interface gigabitethernet4
 switchport mode access
 switchport access vlan 100
!
interface gigabitethernet5
 switchport mode access
 switchport access vlan 100
!
interface gigabitethernet6
 description HIVE8
 switchport trunk allowed vlan add 100,110,162
 switchport trunk native vlan 666
!
interface gigabitethernet7
 switchport mode access
 switchport access vlan 100
!
interface gigabitethernet10
 description Trunk_C2960x-1_1/0/27
 switchport trunk allowed vlan add 100,161-162
 switchport trunk native vlan 666
!
exit

Answer 1

I had the same problem (unwanted icmp type 9), leading to some assymetrical routes on my network (impacted devices are ILOs and PDUs), making packets beeing catched by RP-filtering on the gateway.

I was unable to desactivate this functionnality of the switch, so I ended up by added some filter (as ericx), but at the port level :

! Define the ACL to block the multicast packet
mac access-list extended BlockICMP9
deny any 01:00:5e:00:00:00 00:00:00:ff:ff:ff ace-priority 20
exit

! Block the packet at port level
interface TengigabitEthernet1/0/23
 service-acl output BlockICMP9 default-action permit-any

This rule may be a bit overkill (not enough precise), but since there is no multicast on my network, it's far enough, and working fine.

Greg.

Answer 2

There does not appear to be a knob to disable IPv4 RA short of disabling layer 3 on the switch altogether.

so: set system mode switch will do that. This causes your entire config to be reset to factory and, obviously, removes all layer 3 capabilities.

I did create a multicast filter:

...

bridge multicast filtering

...

!
interface vlan 161
 name SSSG
 ip address 192.168.161.116 255.255.255.0
 no ip address dhcp
 bridge multicast address 01:00:5e:00:00:01
 bridge multicast forbidden address 01:00:5e:00:00:01 add gi14
 bridge multicast forbidden forward-all add gi14
!

However, while this filter did successfully block the RA from the other SG300's, it still allowed the RA from itself.

Normally I don't think the RA should be a problem. This is the first time I remember seeing it in IPv4. The packets have no information in them beyond the sender's IP address and expiration time. There are no routes listed.

Sadly 4 manually configured HP printers on the same network took the first RA they saw after reboot and used the IP therein instead of the hard-coded one as their gateway. The printers would function correctly for some period of time less than 10 minutes after reboot and then basically disappear.