VLAN tag and CDP packets issue

[aurelien personnaz]

Hello,

We have a minor but quite annoying issue regarding VLANs, CDP, and two switches connected together and sharing VLANs.

Let's try to explain.
The first switch is a WS-8-150-DC fw 1.4.8rc7
The second is a WS-6-MINI fw 1.4.8rc7
Both switches have CDP enabled.

Here is a (pretty ugly) schema of the problematic area :

So on this site, we have a mikrotik router, with CDP enabled and active on all interfaces, and a few vlan interfaces

• vlan 1 is for the local site, i.e. the router, the two switches, and a local support AirGateway
• vlans 101 and 102 are used for some inter-site links
• vlan 2222 is used for all the local BTS (connected on either switches)

The main problem we have is that nobody discovers the switch 2. Neither the router nor the switch1.
While investigating it we realized that the whole discovery thing was pretty strange.

• Nobody sees the switch 2
• Both switches don't see each other
  
• The BTSs connected to the switch 2 are discovered by switch 2 and the router, but not by switch 1

It seems to me like there would be an issue with the CDP packets that are tagged by the switches.
The AirGateway on the same vlan as the two switches is discovered eveywhere, and it seems that the main difference is that it is connected to an untagged port...

So we would like to know if you think it could be a bug or just a configuration mistake?

Here are the VLAN tables of both switches
switch1 :

switch2 :

[yahel]

When Aurelien write BTS - he means Ubiquiti APs. (All UBNT devices have CDP enabled).
The Mikrotik router is on port 6 of switch-1. It's the trunk port.
Switch-2 is on port 1 of the switch-1, it's also a VLAN trunk.

I see nothing wrong with the config, this must be something strange related to CDP frames that have VLAN tags...
No other problems, site works well, apart from this discovery issue.
Could it be that Ethernet-broadcast frames (not just CDP) with VLAN tags gets dropped somehow?

Thanks,

Yahel.

[Julian]

What's the list of allowed vlans on the affected trunk ports? 1-4095 or an explicit set?

[aurelien personnaz]

It's 1-4095.

[Julian]

I'm not implying strict causality, but recommended best practice on a trunk port is only traversing VLANs be allowed.
I'll do a little labbing around tomorrow, to see what luck i have with duplicating.

[mike99]

The device at the right view both switch 2 and the router via CDP ? Can you double check ? Any device can view the switch 2 via CDP ? Could you make a other schema with reference name for every device ?

[aurelien personnaz]

The devices on the right of the switch 2 are Ubiquiti APs that do not run CDP discoveries (they only advertise themselves). So we can't know what they see on CDP.
With the UBNT discovery, they don't see the switch 2, but it's quite logical since the switch 2 is not on the same VLAN, isn't it?
Though the switch 2 discovers them...

The CDP packets must go through the switches 1 & 2 since the router sees them.

Absolutely no device can see the switch 2 via CDP, this is how we detected this issue.

I don't think another schema would help. Everything to the top and to the right are ubiquiti APs. You could simplify with a "Top ubiquiti AP" and a "Right ubuiquiti AP"...

[aurelien personnaz]

Hi!

Still no clue about what could be wrong with this setup?

[Eric Stern]

I did some quick investigation and its possible we are not handling CDP correctly when used with VLANs. Currently all CDP frames are always sent untagged and thus are implicitly on VLAN 1. Based on what I've read when CDP is sent on a trunk port it should be tagged as VLAN 1. Since you have Port 1 configured as a trunk port it will not allow any untagged frames and so the CDP frames will be dropped. If you change the VLAN configuration of VLAN 1 for Port 1 to be a "U" instead of a "T" then CDP should start working.

I'll look into fixing this properly.

[yahel]

Thanks, Eric.
We could change the port to be "U" on VLAN-1, instead of just the trunk, and it's probably fine for a single location, but this is a network-wide issue for us.
We have about 50 Netonix switches on this network.
When using "U" on the trunk we "leak" information across VLANs (this negatively affect discoveries, and such broadcast packets)...

No rush, but would love to get this fixed.

Thanks!

Yahel.