<html>
<body>
<br><br>
I don't have the info myself, but I can get it from the person who opened
the ticket with Extreme when he gets back in the office later
today. I do know that multiple MAC addresses have leaked from
various parts of our network, and the times are variable (sometimes in
the middle of the night, sometimes during the afternoon, etc..)<br><br>
Torix has given us packet captures which we've forwarded to TAC.
TAC said that the ACLs don't block all CPU forwarded or generated
packets, and this is expected behavior, so there is no
resolution.<br><br>
Their suggestion was to put another switch between us and Torix, with
another ACL in order to filter the traffic....<br><br>
I suspect they're going to close our ticket at this
point. This is a real pain, as we have 10 of the Summit
switches and two Black Diamond switches set up in a ring. Changing
to a new vendor is expensive and time consuming.<br><br>
<br>
At 09:20 PM 21/07/2014, Changjie wrote:<br><br>
<blockquote type=cite class=cite cite="">Hello Clayton, <br><br>
I am thinking of the followings:<br><br>
1/ Can TORIX shared the MAC address(es) which they detected and blocked?
Good to have the timetamps as well. <br><br>
2/ I currently not in my office to access my lab switches. If I am not
wrong, we can only count but cannot syslog on both terms? <br>
allowonlybr0 and denyall<br><br>
3/ Does the issue happen at certain timing of the day? e.g. lunch hours,
off-peak hours, etc<br><br>
I feel that once we have inputs for Point 1/, we can investigate further.
<br>
e.g. insert a term to explicitly deny this MAC, count it n place as 2nd
entry. We can then check with TAC why this MAC doesnt fall into entry
denyall<br><br>
My 2cents worth. <br>
On 22 Jul, 2014 6:43 am, "Clayton Zekelman"
<<a href="mailto:clayton@mnsi.net">clayton@mnsi.net</a>>
wrote:<br>
<dl><br>
<dd>Hello,<br><br>
<dd>We're running an Extreme Summit X460-24t 15.3.2.11 as an edge switch
facing Torix (Toronto Internet Exchange -
<a href="http://www.torix.net">www.torix.net</a>).<br><br>
<dd>We've been having an issue for quite a while where the Torix switch
will shut down our port because we're leaking packets with a MAC address
other than the one we've got registered with the exchange.<br><br>
<dd>We have an outbound ACL on the port:<br><br>
<dd>Policy: torix<br>
<dd>entry allowonlybr0 {<br>
<dd>if match all {<br>
<dd>Â Â ethernet-source-address 00:22:83:32:d7:19 ;<br>
<dd>}<br>
<dd>then {<br>
<dd>  permit  ;<br>
<dd>}<br>
<dd>}<br>
<dd>entry denyall {<br>
<dd>if match all {<br>
<dd>Â Â ethernet-source-address 00:00:00:00:00:00 mask
00:00:00:00:00:00 ;<br>
<dd>}<br>
<dd>then {<br>
<dd>  deny  ;<br>
<dd>}<br>
<dd>}<br><br>
<dd>For some reason, occasionally an ethernet frame with a different
source MAC address is leaking through the ACL.<br><br>
<dd>After running it up the chain with Extreme's support, their response
is:<br><br>
<br>
<dd>"the cpu-forwarded and cpu-generated packets are not blocked by
an Egress ACL "<br><br>
<br>
<dd>This basically makes the switch unusable at Torix, as they auto shut
your port for 60 minutes if you leak any MAC addresses other than the one
you've registered.<br><br>
<dd>Anyone have any ideas, or do we just junk all our Extreme switches
and start over?<br><br>
<br><br>
<br><br>
<br>
<dd>---<br><br>
<dd>Clayton Zekelman<br>
<dd>Managed Network Systems Inc. (MNSi)<br>
<dd>3363 Tecumseh Rd. E<br>
<dd>Windsor, Ontario<br>
<dd>N8W 1H4<br><br>
<dd>tel. <a href="tel:519-985-8410">519-985-8410</a><br>
<dd>fax. <a href="tel:519-985-8409">519-985-8409</a> Â Â
  <br>
<dd>_______________________________________________<br>
<dd>extreme-nsp mailing list<br>
<dd><a href="mailto:extreme-nsp@puck.nether.net">
extreme-nsp@puck.nether.net</a><br>
<dd>
<a href="https://puck.nether.net/mailman/listinfo/extreme-nsp" eudora="autourl">
https://puck.nether.net/mailman/listinfo/extreme-nsp</a><br>
</blockquote>
<x-sigsep><p></x-sigsep>
</dl>---<br><br>
Clayton Zekelman<br>
Managed Network Systems Inc. (MNSi)<br>
3363 Tecumseh Rd. E<br>
Windsor, Ontario<br>
N8W 1H4<br><br>
tel. 519-985-8410<br>
fax.
519-985-8409<x-tab> </x-tab>
</body>
</html>