No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

NE40E-M2 V800R010C10SPC500 Feature Description - LAN Access and MAN Access 01

This is NE40E-M2 V800R010C10SPC500 Feature Description - LAN Access and MAN Access
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Understanding MAC Flapping-based Loop Detection

Understanding MAC Flapping-based Loop Detection

MAC flapping-based loop detection is a method for detecting Ethernet loops based on the frequency of MAC address entry flapping. It eliminates loops on networks by blocking redundant links. On a virtual private LAN service (VPLS) network, MAC flapping-based loop detection can be applied to block attachment circuit (AC) interfaces and pseudo wires (PWs). This section describes AC interface blocking.

On the network shown in Figure 13-1, the consumer edge (CE) is dual-homed to the provider edges (PEs) of the Ethernet network. To avoid loops and broadcast storms, deploy MAC flapping-based loop detection on PE1, PE2, and the CE. For example, when receiving user packets from the CE, PE1 records in its MAC address table the CE MAC address as the source MAC address and port1 as the outbound interface. When PE1 receives packets forwarded by PE2 from the CE, the source MAC address of the packets remains unchanged, but the outbound interface changes. In this case, PE1 updates the CE's MAC address entry in its MAC address table. Because PE1 repeatedly receives user packets with the same source MAC address through different interfaces, PE1 constantly updates the MAC address entry. In this situation, with MAC flapping-based loop detection, PE1 detects the MAC address flapping and concludes that a loop has occurred. PE1 then blocks its port1 and generates an alarm, or it just generates an alarm, depending on user configurations.
Figure 13-1 User network dual-homed to a VPLS network

After MAC flapping-based loop detection is configured on a device and the device receives packets with fake source MAC addresses from attackers, the device may mistakenly conclude that a loop has occurred and block an interface based on the configured blocking policy. Therefore, key user traffic may be blocked. It is recommended that you disable MAC flapping-based loop detection on properly running devices. If you have to use MAC flapping-based loop detection to detect whether links operate properly during site deployment, be sure to disable this function after this stage.

The basic concepts for MAC flapping-based loop detection are as follows:
  • Detection cycle

    If a device detects a specified number of MAC address entry flaps within a detection cycle, the device concludes that a loop has occurred. The detection cycle is configurable.

  • Temporary blocking

    If a device concludes that a loop has occurred, it blocks an interface or PW for a specified period of time.

  • Permanent blocking

    After an interface or a PW is blocked and then unblocked, if the total number of times that loops occur exceeds the configured maximum number, the interface or PW is permanently blocked.

    An interface or PW that is permanently blocked can be unblocked only manually.

  • Blocking policy

    MAC flapping-based loop detection has the following blocking policies:
    • Blocking interfaces based on their blocking priorities

      The blocking priority of an interface can be configured. When detecting a loop, a device blocks the interface with a lower blocking priority.

    • Blocking interfaces based on their trusted or untrusted states (accurate blocking)

      If a dynamic MAC address entry remains the same in the MAC address table within a specified period and is not deleted, the outbound interface in the MAC address entry is trusted. When detecting a loop, a device blocks an interface that is not trusted.

    A device on which MAC flapping-based loop detection is deployed blocks PWs based only on the blocking priorities of the PWs. If the device detects a loop, it blocks the PW with a lower blocking priority.

  • Accurate blocking

    After MAC flapping-based loop detection is deployed on a device and the device detects a loop, the device blocks an AC interface with a lower blocking priority by default. However, MAC address entries of interfaces without loops may change due to the impact from a remote loop, and traffic over the interfaces with lower blocking priorities is interrupted. To address this problem, deploy accurate blocking of MAC flapping-based loop detection. Accurate blocking determines trusted and untrusted interfaces by analyzing the frequency of MAC address entry flapping. When a MAC address entry changes repeatedly, accurate blocking can accurately locate and block the interface with a loop, which is an untrusted interface.

In addition, MAC flapping-based loop detection can associate an interface with its sub-interfaces bound with virtual switching instances (VSIs). If a loop occurs in the VSI bound to a sub-interface, the sub-interface is blocked. However, a loop may also exist in a VSI bound to another sub-interface. If the loop is not eliminated in time, it will cause traffic congestion or even a network breakdown. To allow a device to inform the network administrator of loops, enable MAC flapping-based loop detection association on the interface of the sub-interfaces bound to VSIs. In this situation, if a sub-interface bound to a VSI is blocked due to a loop, its interface is also blocked and an alarm is generated. After that, all the other sub-interfaces bound with VSIs are blocked.

Download
Updated: 2019-01-02

Document ID: EDOC1100058405

Views: 16701

Downloads: 18

Average rating:
This Document Applies to these Products
Related Version
Related Documents
Share
Previous Next