Description

This document describes how to troubleshoot when there is mac move on a Juniper switch and how to prevent it.

You need to understand the concept of mac learning and how a table is maintained on a switch, when the switch receives a frame, and associates the MAC address of the sender with the LAN port where it was received. Under loop condition, it can happen that the same MAC is learned via two different ports on the switch.This might lead to latency in the network and other network problems.

Symptoms


Log message:

 

Thu Dec 14 03:01:37 2023 vlan_name vlan_802+802 mac aa:aa:aa:aa:aa:aa was moved from ge-0/0/70.0 to ae5.0 with flags: 0x2101f

 

 

lab@qfx> show arp no-resolve | match 192.168.1.1 | refresh 1

 

---(refreshed at 2023-12-15 05:28:32 UTC)---

 

aa:aa:aa:aa:aa:aa 192.168.1.1 irb.802 [ge-0/0/70.0] none

 

---(refreshed at 2023-12-15 05:28:36 UTC)---

 

aa:aa:aa:aa:aa:aa 192.168.1.1 irb.802 [ae5.0] none

Solution

In the above log message, given that mac is moving between ge-0/0/70 and ae5, it would indicate that traffic from the firewall mac aa:aa:aa:aa:aa:aa is somehow arriving on that interface. that is the packet's source MAC must be "aa:aa:aa:aa:aa:aa" when it is reaching the device for the switch to update the table.

 

To isolate the issue, you can do the following.

 

  • Execute below command and check the interfaces between which a particular mac is moving :-
> show ethernet-switching mac-learning-log | refresh 1
  • Shut one of the links and monitor the packet on the other interface to track the source. Here in the above example, shut the interface ge-0/0/70 and monitor the traffic on ae5
  • Run the command to track any packet if erroneously received on other interface -- monitor traffic interface ae5 no-resolve extensive matching "ether src aa:aa:aa:aa:aa:aa"
  • Check the topology and see if there are any L2 loops or any errors on the interface.
  • Check for any physical loops on the device itself. 
  • Check for any mis-cabling issues.
  • Check the device configuration and see if there are any interfaces which are are misconfigured.

Note: You can use LLDP to know or verify for any physical loop, since it display the MAC add of the neighbor and the System name, if there is a match with the local switch.

 

Modification History

2023-12-25 : Initial Publication
2024-01-31 : Updated a note in the solution field
2024-07-29 - Visibility modified
2024-10-03 - Updated additional command in Solution