topic Mac address not showing up in ARP table in ICX Switches

Mac address not showing up in ARP table

war — Mon, 15 Jul 2024 20:56:23 GMT

Good Everyone,

I am new to Ruckus so maybe I am not looking at this correctly but here it goes I have 2 Ruckus ICX 7850 stack switches that have physical connections to a Checkpoint Firewall (primary and secondary). I am running VRRP on the firewalls so the ICX switches connect to a virtual IP address. I can see that both ICX switches is learning a MAC from the directly connected interfaces

ICX-Stack1#sh mac-addr ethe 1/1/29

Total active entries from port 1/1/29 = 1

MAC-Address Port Type VLAN

001c.7fa5.089c 1/1/29 Dynamic 7

ICX-Stack2#sh mac-addr ethe 1/1/29
Total active entries from port 1/1/29 = 1
MAC-Address Port Type VLAN
001c.7fa5.0934 1/1/29 Dynamic 7

I find it weird that when I am on FW1 which connects directly to Stack1 that the ARP table doesn't see that MAC address as it is directly connected to FW1

ICX-Stack1#sh arp

Total number of ARP entries: 2

Entries in default routing instance:

No. IP Address MAC Address Type Age Port Status

1 10.1.7.1 None Dynamic 4 mgmt1 Pend

2 10.1.7.36 0050.568f.f3ec Dynamic 0 mgmt1 Valid

But Stack2 sees it

ICX-Stack2#sh arp
Total number of ARP entries: 3
Entries in default routing instance:
No. IP Address MAC Address Type Age Port Status
1 10.1.7.1 001c.7fa5.089c Dynamic 2 mgmt1 Valid
2 10.1.7.2 001c.7fa5.089c Dynamic 1 mgmt1 Valid
3 10.1.7.36 0050.568f.f3ec Dynamic 1 mgmt1 Valid

When I fail over to FW2 both show the same thing

Total number of ARP entries: 2

Entries in default routing instance:

No. IP Address MAC Address Type Age Port Status

1 10.1.7.1 None Dynamic 4 mgmt1 Pend

2 10.1.7.36 0050.568f.f3ec Dynamic 0 mgmt1 Valid

I checked the FW and they are configured the same, also check the ICX switches and they are configured the same so not sure what I am missing here.

Also we are using the management port to get to these switches remotely, not sure why this was configured as I hear that is a bad idea.

Thank you in advance!!!

Warren

Re: Mac address not showing up in ARP table

Chandini — Tue, 16 Jul 2024 15:55:01 GMT

Hi War

Thank you for reaching us

Could you please help me with below details from both ICX Stack 1 and ICX Stack 2

ping <ip address of the firewall>
show arp
show ip interface
show version

Thanks

Re: Mac address not showing up in ARP table

jdryan — Sat, 20 Jul 2024 12:27:32 GMT

Hi War,

Adding to the above, could you also help with a network diagram detailing the connections?
As that could help us understand the behavior better.

As the management connection [ OOBM/Mgmt ports ] is usually used as dedicated connection,
For the connection layout, with one currently in place with firewalls running VRRP over the Mgmt connections to the switches, would suggest using in-band network management, as that could streamline things a bit.

Thanks !!

Re: Mac address not showing up in ARP table

war — Mon, 22 Jul 2024 19:23:22 GMT

Hello All;

Just wanted to give an update on this, looks like this is working now. I am now able to get to both switches with no issues.

SSH@Stack1_LO41#
SSH@Stack1_LO41#sh arp
Total number of ARP entries: 3
Entries in default routing instance:
No. IP Address MAC Address Type Age Port Status
1 10.1.7.1 001c.7fa5.089c Dynamic 2 mgmt1 Valid
2 10.1.7.2 001c.7fa5.089c Dynamic 0 mgmt1 Valid
3 10.1.7.36 0050.568f.f3ec Dynamic 0 mgmt1 Valid
SSH@Stack1_LO41#

SSH@Stack2_LO38#sh arp
Total number of ARP entries: 3
Entries in default routing instance:
No. IP Address MAC Address Type Age Port Status
1 10.1.7.1 001c.7fa5.089c Dynamic 1 mgmt1 Valid
2 10.1.7.2 001c.7fa5.089c Dynamic 0 mgmt1 Valid
3 10.1.7.36 0050.568f.f3ec Dynamic 1 mgmt1 Valid
SSH@Stack2_LO38#

Just a quick background so you don't have to go back to the top to reread everything....I am using the management interface to access these 2 ICX 7850 switches. I normally don't like using the management interfaces but that's how these where set up before I got here. Both stacks( stack1 and stack2) are being used as a layer 2 switch, these have direct connects into the both firewall (FW1 and FW2). When FW1 is on line Stack1 is the active switch and I am able to get to stack2 remotely but not stack1 which is directly connected to FW1. When FW2 is on line Stack2 is the active switch and I cannot get to neither switches. When I do a show arp on either swtiches I get

1 10.1.7.1 None Dynamic 4 mgmt1 Pend

There are multiple vlans on these stacks which have direct connects into the firewall. The firewall we are using as a layer 3 device to do the routing/switching. From the multiple VLANs, an IP on vlan 7 was used as the management IP. Not to bore you with details but long story short the way the issue was resolved was that I accidently created VE7, once that was done the mac address for 10.1.7.1 went from pending to valid and now I am able to connect to both switches remotely without having to be on the same subnet or use the console server. But that is what happened. As a test to verify this I am planning to failover to FW2 , I shouldn't be able to connect to either switch, will test that first and then create the VE7 interface and see if I am able to connect. But for now that is how I am able to get to both switches remotely now.

@Chandini sorry I saw your message after it was "fixed" but everything works now, will post my findings once I am able to failover to FW2 where nothing works.

Thank you all!!

Re: Mac address not showing up in ARP table

Chandini — Thu, 25 Jul 2024 16:30:22 GMT

Hi War

Sure and Thanks