Manage network broadcasts on Cisco switches using storm control

Network broadcasts can create a huge amount of traffic on your organization's network. When one device sends out a single broadcast, that broadcast goes to all devices on the subnet or VLAN.

How can you manage these broadcasts to make your network more efficient? One method is to use Cisco Catalyst broadcast suppression—also known as storm control.

Broadcasts are a natural part of the TCP/IP suite of applications. A broadcast is a packet sent to ALL HOSTS or ALL HOSTS ON A SUBNET.

A packet sent to all hosts has a destination IP address of 255.255.255.255. A packet sent to all hosts on a subnet is a directed broadcast, and it goes to a specific destination—for example, 10.1.1.255.

Some necessary protocols such as Address Resolution Protocol (ARP) and Dynamic Host Configuration Protocol (DHCP) use broadcasts, so they aren't something you can just throw out. What you can do is suppress excessive broadcasts on your network using storm control.

Configure storm control

It's important to protect your organization's LAN from broadcast storms, which can cause network slowdowns if they become severe. With the Cisco IOS, you can easily and quickly protect your network by configuring a single command on each switch interface.

You can configure storm control on most Cisco Catalyst platforms. (On older platforms, Cisco calls it broadcast suppression.) The Cisco IOS disables broadcast suppression by default.

Storm control manages how the receiving port handles the broadcast. You can configure a threshold to drop broadcasts for a certain period of time or until the broadcast flow slows down.

By default, the switch only drops the broadcast packets. In addition, you can shut down the port or send a SNMP trap to your management station.

Here's how to configure storm control on a Catalyst 2950 switch:

Switch(config)# int fa0/19
Switch(config-if)# storm-control broadcast level 50
Switch(config-if)# storm-control action trap

The first command—storm-control broadcast—is the only required command. Thestorm-control action trap command is optional, as is shutting down the port, which requires the storm-control action shutdown command.

This example has nothing to do with regular unicast or multicast traffic. However, you can configure storm control for both unicast and multicast traffic by substituting unicastor multicast for broadcast in the command.

Once you've configured storm control, you can check the status of the configuration with the show storm-control broadcast command. Here's an example of the output:

Switch# show storm-control broadcast 
Interface Filter State Trap State  Upper    Lower  Current  Traps Sent
--------- ------------  ---------  -----    -----  -------  ---------
Fa0/1     inactive    inactive     100.00%  100.00%    N/A     0
Fa0/2     inactive    inactive     100.00%  100.00%    N/A     0
Fa0/3     inactive    inactive     100.00%  100.00%    N/A     0
Fa0/4     inactive    inactive     100.00%  100.00%    N/A     0
Fa0/5     inactive    inactive     100.00%  100.00%    N/A     0
Fa0/6     inactive    inactive     100.00%  100.00%    N/A     0
Fa0/7     inactive    inactive     100.00%  100.00%    N/A     0
Fa0/8     inactive    inactive     100.00%  100.00%    N/A     0
Fa0/9     inactive    inactive     100.00%  100.00%    N/A     0
Fa0/10    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/11    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/12    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/13    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/14    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/15    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/16    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/17    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/18    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/19    Forwarding  Below rising 50.00%   50.00%     0.00%   0
Fa0/20    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/21    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/22    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/23    inactive    inactive     100.00%  100.00%    N/A     0
Fa0/24    inactive    inactive     100.00%  100.00%    N/A     0
Switch#

For more technical information on Cisco Catalyst Storm Control, check out Cisco's "Configuring Storm Control" documentation.

Source of the picture above is from this link.

Cisco Catalyst Switch bandwidth limit configuration

In the Cisco IOS on a Catalyst switch (not on a router), there’s an Interface Mode command called shape round-robin queue bandwidth. More specifically, the command is srr-queue bandwidth.

This command has been around since IOS 12.2(25). For these examples, I’m using a Cisco Catalyst 2960 switch.

Entering the command appended with a question mark will display the command options. Here’s an example:

Switch(config)# interface FastEthernet 0/1
Switch(config-if)# srr-queue bandwidth ?
  

limit              Configure bandwidth-limit for this interface
  

shape             Configure shaping on transmit queues
  

share              Configure shared bandwidth

As you can see, the command options are limit, shape, and share. While we’ll focus on the limit option this time, keep in mind that you can also use the srr-queue bandwidth command to shape and share bandwidth.

For example, let’s say you have a 100-Mb Ethernet port on a Catalyst switch. You’re selling the bandwidth on the port, and a customer has bought 10 Mb of bandwidth. Obviously, you want to limit the outbound bandwidth on the port to 10 Mb instead of the full 100 Mb.

To do so, go to Interface Configuration Mode on the switch port, and apply the srr-queue bandwidth limit command. Here’s an example:

Switch(config)# interface FastEthernet 0/1 

Switch(config-if)# srr-queue bandwidth limit 90

The 90 sets the outbound bandwidth limit on the port to 90 percent of the port speed. Since this is a 100-Mb port, this should limit the outbound traffic from the port to 10 Mb.

Variations on bandwidth limiting

As with just about everything in the Cisco IOS, there are multiple ways to accomplish the same thing. One way would be to manipulate the port speed. But if you want to hard-code the port speed on the Ethernet port to 10 Mb, you could also limit the customer to only 10 Mb of bandwidth using the speed 10 command. However, you probably won’t get the same level of performance from the 10-Mb Ethernet port.

What if you want a port speed that’s less than 10 Mb? You could limit the port speed to 10 Mb and then use the srr-queue bandwidth limit 90 command to limit the outbound speed of the port to only 1 Mb.

What if you’re working with a Cisco router instead of a switch? Cisco routers don’t support the srr-queue command. While there are several different QoS options that might accomplish the same thing, a common method that I’ve used is the rate-limitcommand.

For example, on a Cisco router when in Interface Mode, you could limit outbound bandwidth to 1 Mb using the following command:

Router(config-if)# rate-limit output 10000000 2000 2000 conform-action continue exceed-action drop

Cisco Catalyst 3560 Loopback Error Recovery

Recently we encountered an issue on Cisco Catalyst 3560 switch in which ports Fa0/10 and Fa0/22 has been disabled automatically by the IOS Software due to an error.

First thing to do is determine the cause of the error. This topic can be found on the Cisco website on this link.

IOS commands issued to determine the error.

In my case I always utilize putty in accessing Cisco IOS.

Login to Cisco IOS (telnet) using putty then enter the equivalent password for Cisco IOS

Run enable command then enter the equivalent password

Then run this command to determine the status of the port

Switch26# show interface Fa0/10 status
Port Name Status Vlan Duplex Speed Type
Fao/10 err-disabled 1 auto auto 10/100BaseTX


To determine the cause of the error run the following command
# show log

This command will dump a log on all the ports. Check specifically the logs on the port that encountered the issue.
In our case its interface Fa0/10

The log would show up something like this

%PM−4−ERR_DISABLE: loopback error detected on Fa0/10, putting Fao/10 in
err−disable state

So the error encountered was a loopback.

Cisco Catalyst 3560 Switch loopback issue

A loopback error occurs when the keepalive packet is looped back to the port that sent the keepalive. The switch sends keepalives out all the interfaces by default. A device can loop the packets back to the source interface, which usually occurs because there is a logical loop in the network that the spanning tree has not blocked. The source interface receives the keepalive packet that it sent out, and the switch disables the interface (errdisable). This message occurs because the keepalive packet is looped back to the port that sent the keepalive:

The suggested workaround is to disable keepalives and upgrade to Cisco IOS Software Release
12.2SE or later.

Run the following command to disable keepalive on a particular port

Switch26#configure terminal
Switch26 (config) #interface Fa0/10
Switch26 (config) #no keepalive
Switch26 (config)end

Run this command to check the current configuration
Switch26#show running-config interface Fa0/10
Building configuration...

Current configuration : 48 bytes
!
interface FastEthernet0/10
no keepalive
end

Copy the running configuration to the startup configuration

Switch26#copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]
Switch26#

Now we need to enable the new settings to the port by resetting the port

Run the following command shutdown and no shutdown


Switch26#
Switch26#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch26(config)#interface Fa0/10
Switch26(config-if)#shutdown
Switch26(config-if)#end
Switch26#show running-config interface Fa0/10
Building configuration...

Current configuration : 58 bytes
!
interface FastEthernet0/10
no keepalive
shutdown
end

Switch26#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch26(config)#interface Fa0/10
Switch26(config-if)#no shutdown
Switch26(config-if)#end
Switch26#show running-config interface Fa0/10
Building configuration...

Current configuration : 48 bytes
!
interface FastEthernet0/10
no keepalive
end

Switch26#

That’s all folks . . .