time to live exceeded

  • 0
  • 1
  • Problem
  • Updated 4 years ago
Hi Everyone,

very suddenly our bunch of extreme x670v, x480 become unavailable over management IP address and IP addresses assigned to different vlans.

After an hours of investigation we found that we can access them from the ip addresses of the same subnets assigned over different vlans but all request which are coming from another subnets are dropped.

the problem as we found is in TTL value assigned to the packets which are outcoming from the switch to default gw - it is set to 1. If we do 'ping ttl 10 host' it works fine.

very long time back there was one message in the logs of the 670v: Slot-2: IPv4 multicast entry not added. Hardware L3 Table full. but we don't think that is the case.

we did quite a lot of research overnight in docs and different forums - etc. nothing found.

the configuration is quite simple: we don't use any routing, bgp, ospf, etc.

Please give us clue what can cause that issue and how it can be fixed. 

Thanks,
Nikolay

Photo of Nikolay Krasko

Nikolay Krasko

  • 120 Points 100 badge 2x thumb
  • sad

Posted 4 years ago

  • 0
  • 1
Photo of Sumit Tokle

Sumit Tokle, Alum

  • 5,738 Points 5k badge 2x thumb
Nikolay,

Use snmp get command to see what is the current TTL value on Extreme device,

a2-emrd-lm-mx.9 # show snmp get 1.3.6.1.2.1.4.2.0
mib_2.4.2.0 = 64

If it's not 64 and showing 1 then use below command on snmp tool to change the ttl value back to 64.

snmpset -r 10 -v 2c -c private 10.67.72.69 .1.3.6.1.2.1.4.2.0 i "64"

I would suggest to check any vulnerable packets are coming from the NMS server which is changing the TTL value. 
I would like you to follow below stepsm to avoid this issue in future,

1)Disable the community string which you don't used.
2)Configure the SNMP access profile to allow only certain IP to get the access of switch or you can disable the SNMP access(command: disable snmp access)
(Edited)
Photo of Nikolay Krasko

Nikolay Krasko

  • 120 Points 100 badge 2x thumb
Hi Sumit, all done and works now. We are proceeding with the recommendations you've made to prevent this in future. Thanks, Nikolay
Photo of Sumit Tokle

Sumit Tokle, Alum

  • 5,738 Points 5k badge 2x thumb
1)      Use the built-in text editor “vi” to create the policy:

a.       Issue the command, “vi snmp_access.pol

b.      Now type “i” to allow us to paste the following policy:

entry snmp_access {

if {

source-address <IP ADDRESS of NMS>/32;

}

then {

permit;

}
entry snmp_deny{

If {

}

                                          then{

                                          deny;

                                          }

                                          }

2)      Now let’s apply this policy to deny everyone SNMP access except for the NMS server or other reliable sources.

a.       Issue the command, “configure snmp access-profile snmp_access


----------------------------------------------------------------------------------------


To see the active snmp community execute the command:

"show snmpv3 community". 


If you are not using any community then it's recommend to delete that community using the command,

configure snmp delete community readwrite private

configure snmp delete community readonly public

----------------------------------------------------------------------------------------

Once you configure the SNMP access-profile you would see the source IP address which is denied by the SNMP Rule which was trying to access the switch using the snmp get or set command in log.


06/16/2014 14:36:01.79 <Warn:SNMP.Master.DropReqAccessDeny> SNMP access from source 10.120.89.75 is denied by rule test. Dropping this Request.

Photo of Sumit Tokle

Sumit Tokle, Alum

  • 5,738 Points 5k badge 2x thumb
The switch without password can be access by anyone so to provide the security we would configure the password.

Similar way, without snmp access profile anyone can access or modify the switch configuration through snmp get or set operation. In order to provide the security we can configure above methods.

Hope this would help you.

Photo of Alexander Shikov

Alexander Shikov

  • 60 Points
Dear Sumit,

I've get into the same issue. Is there any chance to adjust default TTL value from CLI?
Thanks in advance!
Photo of Sumit Tokle

Sumit Tokle, Alum

  • 5,738 Points 5k badge 2x thumb
Hi Alexander,

There is no CLI command available at this moment to change the TTL value. However, you can send SNMP OID and set the TTL value as per your requirement.

 It is recommended that not to change the default TTL value.
(Edited)