Description

This article describes that MAC limit is not a supported feature over the MC-LAG ICL link on devices running Junos OS and that configuring such a limit can cause traffic blackholing over the interchassis control link (ICL).

The article recommends not configuring mac-limit on any of the VLANs that are part of the ICL on all supported Junos OS releases.

Symptoms

Topology

AE1000 is a trunk link that allows multiple customer VLANs over it.

SW01 A ----- ICL AE1000 (irb.2) ---- SW01 B
  |                                    |
  |--------- Downstream SW ------------|
 

Triggers for ICL black holing

 

  1. mac-limit configuration on at least one VLAN, which is a part of the trunk interface ae1000, that is, ICL on either MC-LAG peers or both SW01A / SW01B

set vlans vlan100 switch-options interface-mac-limit 4000
set vlans vlan100 switch-options interface-mac-limit packet-action drop-and-log

  1. Reboot of an FPC, which is part of ae1000, or reboot of the entire switch on any of the peers

Note that flapping of the ae1000 interfaces does not trigger this issue.

 

Symptoms

 

  • On the problematic switch, “monitor traffic interface irb.2” will show only OUT packets. No IN packets will be seen.

  • OSPF neighborship on irb.2 will be broken.

  • Status of the Virtual Router Redundancy Protocol (VRRP), which is configured over ICL, on both peer sides will be primary/primary.

  • The dlu.smac_da_lkp_fail(21) counter can be seen incrementing on all the FPCs of the problematic switch.

root@SW01A-re0:0% vty fpc0
Switching platform (1600 Mhz QorIQ P5020 processor, 3071MB memory, 8192KB flash)
FPC0(SW01A-re0 vty)# show pechip trapstat
DEV    TRAPCODE                      count        rate
======================================================================================

 <snip>
 4 ( 21) dlu.smac_da_lkp_fail        194          1  
 
FPC0(SW01A-re0 vty)# show pechip trapstat
 
DEV    TRAPCODE                      count        rate
======================================================================================

 <snip>
 4 ( 21) dlu.smac_da_lkp_fail        224          1

Solution

To recover from the issue, you should remove the mac-limit configuration on the VLANs that are part of ae1000 on SW01A/B.

Note that users can encounter this issue on any Junos OS code because the mac-limit feature is not compatible with MC-LAG over ICL trunk VLANs. This is as per design.

It is recommended not to have mac-limit configuration on any of the VLANs that are part of the ICL on all supported releases.

Modification History

2022-06-30: Minor formatting correction in topology

Related Information