Help: H3C port security policy causes the switch to fail to learn the interface

Started by justrest, March 18, 2023, 04:03:21 AM

Previous topic - Next topic

justrest

We need to locate the IP or mac address quickly, but if we configure a port security policy on the switch interface (as shown in the figure), the mac address status on the switch is "secure" instead of "learned". The problem is that netxms only learns the mac address of the "learned" state ( Switch Forwarding Database  ), the mac address of the "security" state seems to be ignored, please ask what is the way to learn all the mac addresses, thank you very much!

justrest

I have tried different versions from 4.2.461 to 4.3.2, including windows and debian systems, and found the same result.

Victor Kirhenshtein

Hi,
could you please share SNMP walk output on .1.3.6.1.2.1.17.7.1.2.2.1?
Best regards,
Victor

Victor Kirhenshtein

So H3C returns non-standard value 6 for dot1qTpFdbStatus. Interestingly they don't mention this value even in their own documentation on Q-Bridge-MIB (found it here: https://www.h3c.com/en/d_202211/1719268_294551_0.htm).
Can you please explain what is the difference between "secure" and "learned" state?

justrest

When the port opens the security policy, the port's mac address status will change from "learned" to "secure", which seems to be the official definition, but I don't know why it can't be learned by netxms。
Thanks for your replies!

Victor Kirhenshtein

I've added processing of FDB record status 6 - next patch release should process them in a same way as status 3 (dynamic).

Best regards,
Victor

justrest

Quote from: Victor Kirhenshtein on April 26, 2023, 06:38:35 PMI've added processing of FDB record status 6 - next patch release should process them in a same way as status 3 (dynamic).

Best regards,
Victor

thanks very much!!

justrest

Quote from: Victor Kirhenshtein on April 26, 2023, 06:38:35 PMI've added processing of FDB record status 6 - next patch release should process them in a same way as status 3 (dynamic).
Best regards,
Victor
The problem has been solved in the just released version 4.3.6, thank you very much!