华为MAC地址漂移检测实验

背景信息

MAC地址漂移是指设备上同一个VLAN内有两个或者三个端口学习到一个MAC地址，后学习到的MAC地址表项覆盖原MAC地址表项的现象。我们通常认为第一个学习到MAC地址的接口是正确的出接口，称为源端口（Original Port），后学习的端口是漂移端口（Move Port），漂移端口通常是在环路上的或者下挂网络中有环路的端口，需要关闭漂移端口或者在漂移端口上配置风暴抑制功能。

实验拓扑

预配配置

R1:
#
interface GigabitEthernet0/0/0
 ip address 10.0.12.1 255.255.255.0 
#
arp static 10.0.12.2 1011-1111-1111

==========================================================================

SW:
vlan 10
 loop-detect eth-loop block-mac block-time 10 retry-times 5
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 10
 stp bpdu-filter enable # 必须开启bpdu过滤, 由于port id大GE0/0/2会被生成树block, 无法进行实验.
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 10
 stp bpdu-filter enable # 开启bpdu过滤, 不然GE0/0/1可能会被生成树block, 无法进行实验.
#
interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 10

实验目的

1. 观察MAC地址漂移现象

实验步骤:

1. 按<<预配配置>>完成实验配置
2. 在R1上执行ping 10.0.12.2
3. 在R1上执行ping 10.0.12.3

预期结果

1. 在R1上ping 10.0.12.2时, 由于已静态绑定了ARP, 所以发送的单播ICMP包, 由于SW MAC地址表为空, 所以该ICMP包会被当着未知单播帧泛洪, 形成环路, 并观察到MAC地址漂移现象.–未知单播帧引起的环路和MAC地址漂移

<R1>ping 10.0.12.2
  PING 10.0.12.2: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 10.0.12.2 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss
============================================================================================
<SW>display mac-address flapping
Mac-address Flapping Configurations :
-------------------------------------------------
  Flapping detection          : Enable
  Aging  time(sec)            : 300 
  Quit-vlan Recover time(min) : 10 
  Exclude vlan-list  : -
-------------------------------------------------

<SW>display mac-address flapping record  # 在SW上查看到了MAC地址漂移记录
 S  : start time                                                                
 E  : end time                                                                  
(Q) : quit vlan                                                                 
(D) : error down                                                                
------------------------------------------------------------------------------- 
Move-Time             VLAN MAC-Address   Original-Port   Move-Ports      MoveNum
------------------------------------------------------------------------------- 
S:2023-12-03 15:34:55 10   00e0-fc2e-6589 GE0/0/3         GE0/0/2         3166 
E:2023-12-03 15:34:57                                     GE0/0/1        
------------------------------------------------------------------------------- 
Total items on slot 0: 1

2. 在R1上ping 10.0.12.3时, 会发送ARP广播包, 在SW上能看到MAC地址漂移现象. --广播帧引起的环路和MAC地址漂移

 <R1>ping 10.0.12.3
  PING 10.0.12.3: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 10.0.12.3 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss
===========================================================================================
<SW>display mac-address flapping record  # 在SW上查看到了MAC地址漂移记录
 S  : start time                                                                
 E  : end time                                                                  
(Q) : quit vlan                                                                 
(D) : error down                                                                
------------------------------------------------------------------------------- 
Move-Time             VLAN MAC-Address   Original-Port   Move-Ports      MoveNum
------------------------------------------------------------------------------- 
S:2023-12-03 15:42:04 10   00e0-fc2e-6589 GE0/0/3         GE0/0/2         3162 
E:2023-12-03 15:42:06                                     GE0/0/1         
------------------------------------------------------------------------------- 
Total items on slot 0: 1

解决方法

1. mac-address flapping trigger error-down，配置发生MAC地址漂移后触发接口Error-Down
2. 开启生成树协议, 接终端(如: 服务器, 电脑等设备)的端口开启stp edged-port enable和stp bpdu-protection
3. 接终端(如: 服务器, 电脑等设备)的端口开启环路检测功能loop-detect eth-loop block-mac block-time