SRX

last person joined: 9 hours ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.

  • 1.  VRRP mac-flap when connecting SRX240's via Cisco switches

    Posted 06-25-2012 21:06

    I'm currently migrating a network from ASA's to SRX's (5510 -> 240h)

     

    I have setup two SRX's connected via Cisco 3560's by dot1q trunks.

    (SRX <-> 3560 <-> 3560 <-> SRX)

     

    The SRX's are running VRRP on 4 VLANs (l3interface)

    vlan.2 (VRRP group 1, VLAN2, vip=10.0.1.1 , lcl=10.0.1.2/3)

    vlan.4 (VRRP group 3, VLAN4, vip=10.0.3.1 , lcl=10.0.3.2/3)

    vlan.7 (VRRP group 6, VLAN7, vip=10.0.6.1 , lcl=10.0.6.2/3)

    vlan.10 (VRRP group 9, VLAN10, vip=10.0.9.1 , lcl=10.0.9.2/3)

    (VLAN and subnet numbers don't match on this network so I went with subnet numbers for VRRP groups)

     

    I'm getting the following error on the 3560's at both ends:

    Jun 26 13:57:45 : %SW_MATM-4-MACFLAP_NOTIF: Host 0000.5e00.0101 in vlan 2 is flapping between port Gi0/21 and port Te0/1
    Jun 26 13:58:17 : %SW_MATM-4-MACFLAP_NOTIF: Host 0000.5e00.0101 in vlan 2 is flapping between port Gi0/21 and port Te0/1
    Jun 26 13:59:00 : %SW_MATM-4-MACFLAP_NOTIF: Host 0000.5e00.0101 in vlan 2 is flapping between port Gi0/21 and port Te0/1
    Jun 26 13:59:31 : %SW_MATM-4-MACFLAP_NOTIF: Host 0000.5e00.0101 in vlan 2 is flapping between port Gi0/21 and port Te0/1
    Jun 26 14:00:36 : %SW_MATM-4-MACFLAP_NOTIF: Host 0000.5e00.0101 in vlan 2 is flapping between port Gi0/21 and port Te0/1
    Jun 26 14:01:18 : %SW_MATM-4-MACFLAP_NOTIF: Host 0000.5e00.0101 in vlan 2 is flapping between port Gi0/21 and port Te0/1
    Jun 26 14:01:40 : %SW_MATM-4-MACFLAP_NOTIF: Host 0000.5e00.0101 in vlan 2 is flapping between port Gi0/21 and port Te0/1
    Jun 26 14:02:01 : %SW_MATM-4-MACFLAP_NOTIF: Host 0000.5e00.0101 in vlan 2 is flapping between port Gi0/21 and port Te0/1

    I can't see any issues on the SRX's themselves - the VRRP summary is reporting the correct master/standby. I haven't actually done a fail-over yet but I just wanted to see if I had anything incorrect.



  • 2.  RE: VRRP mac-flap when connecting SRX240's via Cisco switches
    Best Answer

    Posted 07-16-2012 19:17

    Ok solved it 🙂 The VRRP wasn't actually working correctly because I had not allowed it as a host-inbound protcol!

     

    Once added the mac-flap errors stopped and the VRRP slave reported the master correctly.

     

    set security zones security-zone blah host-inbound-traffic protocols vrrp