Cloud Managed Networks

 View Only
last person joined: 3 days ago 

Forum to discuss all things related to HPE Aruba Networking Central and UXI Network Management, including deployment of managed networks, configuration, best practices, APIs, Cloud Guest, AIOps, Presence Analytics, and other included Applications
Back to discussions
Expand all | Collapse all

Troubleshoot possible loops in the network

This thread has been viewed 30 times

  • 1.  Troubleshoot possible loops in the network

    Posted Jul 22, 2024 12:57 AM

    We have a mixed Cisco-Aruba network.  There seem be a strange issue in one section of the network where one virtual server no matter what IP address I change it to, it tells me its a duplicate IP address.

    I am thinking there may be a loop?  What is the proper way to add bpdu-guard, loop-guard, and root-guard to an existing network to help detects loops within the network? 

    Can Aruba Central help with this issue?



  • 2.  RE: Troubleshoot possible loops in the network

    Posted Jul 22, 2024 09:38 AM

    Do you have spanning-tree enabled on your network?

    Do you see this loop in just one VLAN/one port? Or do you see other issues in your network?

    In Aruba Central, you should be able to see the topology of your network, unfortunately the visibility probably includes the first non-Central-managed switch, but not beyond that. Network loops also tend to generate high port/link utilization, what may show up as an alert in Central.

    If you can run a packet capture on the virtual server (Wireshark, tcpdump, etc), you may see the traffic coming back with the IP you want to assign, and it's MAC address. In other switches, you may check the mac-address table on which ports you see that MAC address and find out the source.

    Looping back may happen if you configure a redundant link (port-channel, LAG, LACP) but only on one side of the link. It may even be your hypervisor connected to the network redundantly.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 3.  RE: Troubleshoot possible loops in the network

    Posted Jul 23, 2024 12:07 PM

    Troubleshooting a possible loop in the network - my favorite question to ask in a interview.

    1. Look at the logs on your switches.  Look for changes in spanning-tree.  Look for TCN packets.  Look for ports going into a disabled/blocked state.
    2. Look at port utilization.  Look at ports that have very high multicast/broadcast and pps (packets per second)
    3. Show spanning-tree - check your path to your root bridge.  Look at the BPDU counters on the ports.
    4.  Show mac-address-table - look for access ports that have multiple MAC addresses on them or ports that you would not assume to have multiple devices connected to them.
    5. Use loop detection guard /loop protection and look for log messages that show loop protection occurring.
    6. Do a packet capture from host that is having issues.  Look at your BPDU packets in the capture.
    7. Do a packet capture from a host that is having issues.  Look at the I/O graphs and look at your packets per second and what is causing high pps.
    8. Enable BPDU guard on all ports that should not be sending BPDU packets to the switch.  This is normally access ports.
    9. Check the status of your bridge IDs and ensure the root bridge/secondary root bridge is correct.  Check for any TCN guard/root guard - ensure they are set correctly.
    10. Check for any ports with BPDU filter enabled or spanning tree disabled.
    11. Check for duplicate mac addresses on multiple ports.
    12. Check logs on the switches for mac-address that are updated/removed very quickly on the network.

    Some other stuff that can help you troubleshoot a possible loop but that should get you started.

    Also, it is possible that you do have a duplicate IP address on the network and it is not a loop.  I was helping a network engineer once that had a duplicate IP issue and he swore that it wasn't.  Everything I was saying over the phone to have him test and everything he was seeing made me believe another device on that network had the same IP.  Turns out that their firewall failed over to the secondary and for some reason one of the interfaces kept a secondary IP address that was removed on the primary firewall.


    Original Message


  • 4.  RE: Troubleshoot possible loops in the network

    Posted Aug 09, 2024 02:59 AM

    Hello

    you can check below-

    BPDU Guard: Use BPDU Guard to prevent loops by disabling ports that receive BPDUs unexpectedly.

    Cisco: spanning-tree bpduguard enable

    Aruba: spanning-tree bpdu-guard

    Loop Guard: Prevents ports from becoming designated ports when BPDUs are lost, maintaining network stability.

    Cisco: spanning-tree loopguard default

    Aruba: spanning-tree loop-guard

    Root Guard: Enforces the root bridge position and prevents external switches from becoming the root.

    Cisco: spanning-tree guard root

    Aruba: spanning-tree root-guard

    Aruba Central: Use it for monitoring the network to detect loops and manage configurations efficiently across devices.

    Troubleshooting:

    Check the MAC address table for duplicates.

    Review network topology for physical loops.

    Examine switch logs for spanning tree changes or IP conflicts.

    Use commands like show ip arp to detect IP conflicts.

    These steps should help detect and resolve potential loops and IP conflicts in your mixed Cisco-Aruba network.

    Thank you


    Original Message


  • 5.  RE: Troubleshoot possible loops in the network

    Posted Aug 23, 2024 06:00 AM

    Not relevant to troubleshooting loops, but the error you describe looks the same... Is this Aruba switches? And do you do aaa port-access / Wired .1x ? Perhaps you have ip client-tracker active? If AOS-S do ip client-tracker probe-delay 120. 



    ------------------------------
    John-Egil Solberg |
    ACMX#316 | ACX-NS | ACCX#902
    ------------------------------

    Original Message