For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Noyan_137135's avatar
Noyan_137135
Icon for Nimbostratus rankNimbostratus
Feb 28, 2014

All VLANs seem to drop the same size of packets

Hi all,

 

In our NNMi system we have some alarms that point all VLANS in our CGN are dropping the same size of packets. What can it be caused by?

 

Critical --X---- 10:03:23 22.02.2014 xxxxx_vipron1.xxxxx.com.tr NNMi 15.47.67.111.109.109.111.110.47.118.108.97.110.... CustomPolledInstance out of range in CustomNodeCollection pbn_sysVlanStatDropsIn /Common/vlan_42 3,733 packets

 

Critical --X---- 10:03:23 22.02.2014 xxxxx_vipron1.xxxxx.com.tr NNMi 15.47.67.111.109.109.111.110.47.118.108.97.110.... CustomPolledInstance out of range in CustomNodeCollection pbn_sysVlanStatDropsIn /Common/vlan_77 3,733 packets

 

Critical --X---- 10:03:23 22.02.2014 xxxxx_vipron1.xxxxx.com.tr NNMi 15.47.67.111.109.109.111.110.47.118.108.97.110.... CustomPolledInstance out of range in CustomNodeCollection pbn_sysVlanStatDropsIn /Common/vlan_80 3,733 packets

 

Critical --X---- 10:03:23 22.02.2014 xxxxx_vipron1.xxxxx.com.tr NNMi 16.47.67.111.109.109.111.110.47.118.108.97.110.... CustomPolledInstance out of range in CustomNodeCollection pbn_sysVlanStatDropsIn /Common/vlan_302 3,733 packets

 

Critical --X---- 10:03:23 22.02.2014 xxxxx_vipron1.xxxxx.com.tr NNMi 15.47.67.111.109.109.111.110.47.118.108.97.110.... CustomPolledInstance out of range in CustomNodeCollection pbn_sysVlanStatDropsIn /Common/vlan_52 3,733 packets

 

Critical --X---- 10:03:23 22.02.2014 xxxxx_vipron1.xxxxx.com.tr NNMi 16.47.67.111.109.109.111.110.47.118.108.97.110.... CustomPolledInstance out of range in CustomNodeCollection pbn_sysVlanStatDropsIn /Common/vlan_464 3,733 packets

 

Critical --X---- 10:03:23 22.02.2014 xxxxx_vipron1.xxxxx.com.tr NNMi 24.47.67.111.109.109.111.110.47.118.108.97.110.... CustomPolledInstance out of range in CustomNodeCollection pbn_sysVlanStatDropsIn /Common/vlan_26_external 3,733 packets

 

Critical --X---- 10:03:23 22.02.2014 xxxxx_vipron1.xxxxx.com.tr NNMi 25.47.67.111.109.109.111.110.47.118.108.97.110.... CustomPolledInstance out of range in CustomNodeCollection pbn_sysVlanStatDropsIn /Common/vlan_107_external 3,733 packets

 

application delivery
LTM
management
security
TMOS
TMSH

10 Replies

  • Night_67217's avatar
    Night_67217
    Historic F5 Account
    Feb 28, 2014

    Wild guess would be MTU issues. Have a read here: http://support.f5.com/kb/en-us/solutions/public/13000/900/sol13948.html?sr=35490402

     

    However, best way to determine the root cause would be starting a tcpdump and checking what types of packets are dropped: http://support.f5.com/kb/en-us/solutions/public/6000/500/sol6546.html?sr=35490422

     

    Did this start all of sudden? What changed in your network? Is this some new type of traffic reaching the BigIP?

     

  • Noyan_137135's avatar
    Noyan_137135
    Icon for Nimbostratus rankNimbostratus
    Feb 28, 2014

    How can MTU Discovery cause packets to drop? In fact these alarms are produced several times in an hour and we don't get how to monitor the drops in specific vlans.

     

  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    Feb 28, 2014

    This doesn't look like it's MTU related to me. Since all vlans are receiving the same packets and dropping them, this seems more like the LTM is seeing unexpected traffic. What's your network setup look like? Are all of these vlans on the same physical interface (trunk) to some switch?

     

  • Noyan_137135's avatar
    Noyan_137135
    Icon for Nimbostratus rankNimbostratus
    Feb 28, 2014

    This NNMi system just monitors the added LTM devices by its alarm policies and produces warning messages. These vlans are not on the same interface, even the LTM's are not in the same location. We are trying to get that if it's related to the created alarms or real packet drops on vlans of LTM's.

     

  • Moe_Jartin's avatar
    Moe_Jartin
    Icon for Cirrus rankCirrus
    Feb 28, 2014

    I agree with Cory... They are all inbound drops on every VLAN. So why is the box dropping them? One thought.... How would untagged packets be treated? Would they be "seen" and dropped by every VLAN? Just thinking out loud. Is there a native or untagged VLAN configured on the upstream switch? Also, could it be multicast traffic?

     

    • Cory_50405's avatar
      Cory_50405
      Icon for Noctilucent rankNoctilucent
      Feb 28, 2014
      This pretty much sums up exactly what I was thinking.
  • Noyan_137135's avatar
    Noyan_137135
    Icon for Nimbostratus rankNimbostratus
    Feb 28, 2014

    Okay that can make somethings clear. So how can we configure the interfaces or trunks if we want untagged packets pass? Besides the LTMs have all vlans tagged and some have trunk ports already. Can the drops be caused by the trunks?

     

  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    Feb 28, 2014

    If this is what Joe and I suspect, it isn't something you're going to be able to fix on your LTM. It's something that would need fixed on your upstream switch.

     

    Can you check the switch ports that connect to your LTMs and see if they are configured to pass tagged vlan traffic on a vlan that isn't configured on your LTM? I think that would be a good place to start.

     

  • Moe_Jartin's avatar
    Moe_Jartin
    Icon for Cirrus rankCirrus
    Feb 28, 2014

    Which ever VLAN is the native to untagged VLAN configured on the switch you just need to configure that VLAN on the F5 side as untagged also. Off the top of my head, in the GUI under Network>VLANS if you go into the properties of that VLAN I believe tagged is to the left and untagged is to the right. Or it could be the other way around. :-)

     

  • Noyan_137135's avatar
    Noyan_137135
    Icon for Nimbostratus rankNimbostratus
    Feb 28, 2014

    When I check three LTMs I can see that all VLANS have trunks in the tagged interfaces and don't have any untagged interface. So at first I will make networkers check the configuration of the switch ports, then we can be able to clear this problem out I guess. :)