SRX

 View Only

  • 1.  BPDU are being blocked by SRX

    This message was posted by a user wishing to remain anonymous
    Posted 22 days ago
    This message was posted by a user wishing to remain anonymous

    Hi there,

    We have an SRX380 chassis cluster running with the following setup:

    set protocol l2-learning global-mode transparent-bridge, 

    set interfaces reth2 unit 10 vlan-id 10,

    set interfaces reth2 vlan-tagging,

    set interfaces reth2 unit 10 family inet address 1.2.3.4/24

    We have two sonic switches running rapid-spanning-tree connected via portchannels over routed vlans.  We can see the BPDU's arriving IN on the SRX but no OUT's.  

    We have added the following:

    set security flow ethernet-switching bypass-non-ip-unicast

    set security flow ethernet-switching bpdu-vlan-flooding

    But still the SRX does not seem to pass the packets. Any ideas?

    Thanks



  • 2.  RE: BPDU are being blocked by SRX

    Posted 22 days ago

    BPDU problems are probably a problematic part of our world. I have issues too. More specifically dhcp snooping and dhcp. More then likely my outdated and obsolete switch. But it does work. I think my problem is a bad cluster #2 switch. It's a bit off i think. I use the flooding statement in srx too, but that's only just flooding. BPDUs should always process, and they probably are for you. What makes you think the traffic isnt going out? Srx is notorious for not showing statistics. It probably is processing and only not showing. BPDUs have a vendor specific knob. So you know. Sonic is not an isp norm I bet.



    ------------------------------
    Adrian Aguinaga
    B.S.C.M. I.T.T. Tech
    (Construction Management)
    A.A.S. I.T.T. Tech
    (Drafting & Design)
    ------------------------------



  • 3.  RE: BPDU are being blocked by SRX

    This message was posted by a user wishing to remain anonymous
    Posted 21 days ago
    This message was posted by a user wishing to remain anonymous

    Hi Adrian,

    I've been running tcpdump on the sonic switches and also a show spanning-tree counters show the TX and RX packets (RX stay at 0).  On the SRX a monitor traffic interface rethx layer2-headers shows STP packets coming "In" from both switches but no "Out".


    Original Message


  • 4.  RE: BPDU are being blocked by SRX

    Posted 21 days ago

    So my first thought is still that the BPDU's ARE transmitting. The traffic that controls BPDU's are a different story, but that traffic is probably transmitting too. As i stated before, srx are famous for holding out on statistical data. The srx's love to be on the subsystem. As opposed to the topological information side. Spoke and hub is an analogy for example. I dont have experience with reth, but I have asus routers in which redundancy in the wlan(i.e. wl1) creates fe80's as redundancy addresses that clone hosts directly in the topology. Asus media bridge. Try and create a reth address and copy an address from a HOST computer. It still may report no traffic, but now find your way around.



    ------------------------------
    Adrian Aguinaga
    B.S.C.M. I.T.T. Tech
    (Construction Management)
    A.A.S. I.T.T. Tech
    (Drafting & Design)
    ------------------------------

    Original Message


  • 5.  RE: BPDU are being blocked by SRX

    This message was posted by a user wishing to remain anonymous
    Posted 20 days ago
    This message was posted by a user wishing to remain anonymous

    Hi again,

    I moved the Sonic switches to uplink their port channel via a switch and BPDU started to arrive.  So it does seem that the SRX is blocking.


    Original Message


  • 6.  RE: BPDU are being blocked by SRX

    Posted 20 days ago

    The switches i use are not only local aware, they are local and default route aware. They have the ability to be global without being locally aware. I think this affects uplinking too. Sonic is something i have not used before. I suppose an example would be ASA. But my switches are not exactly this. A different series of switches in this brand. ASA is legacy, but maybe the same concept has lived on. Hope I got my words correct.



    ------------------------------
    Adrian Aguinaga
    B.S.C.M. I.T.T. Tech
    (Construction Management)
    A.A.S. I.T.T. Tech
    (Drafting & Design)
    ------------------------------

    Original Message


  • 7.  RE: BPDU are being blocked by SRX

    Posted 18 days ago

    So perhaps you've got some things against you. And I am not aware if BPDU's can transmit at the redundancy level. Hard for me to know. I have performed a filtering of BPDU's at the interface level. Not the vlan or irb, but in my srx i use alg->flow->bridge->bpdu flooding. Does anyone know in the monitor traffic command where to find those statistics this gentlemen uses to find in and out? My thoughts about default route awareness is because i think the srx lacks here. But maybe messing with metrics lower then 65535 and you know, hmm say about 59893. Just guessing. Hmmmm

    If you try a metric in the default route as i have said, also try 1602 as a gateway metric. I changed this. My locale needed it.



    ------------------------------
    Adrian Aguinaga
    B.S.C.M. I.T.T. Tech
    (Construction Management)
    A.A.S. I.T.T. Tech
    (Drafting & Design)
    ------------------------------

    Original Message


  • 8.  RE: BPDU are being blocked by SRX

    Posted 19 days ago

    What do you mean by "connected via portchannels over routed vlans" ???

    BPDU flooding should work across interface configured with family bridge (i.e. L2 interfaces). Currently your reth2.10 interface is L3 interface; it won't do anything with BPDUs.



    ------------------------------
    Nikolay Semov
    ------------------------------



  • 9.  RE: BPDU are being blocked by SRX

    Posted 14 days ago

    Your interface is configured as a Layer 3 interface type of "router on a stick" scenario. It does indeed have a VLAN tag associated on the sub-interface (unit), but it's by itself not configured as a Layer 2 interface included in a VLAN. Therefor, it won't pass and participate in Spanning Tree.