https://community.extremenetworks.com/t5/end-of-service-products/rule-srcipguard/m-p/22371#M187 The Summit 7i and ExtremeWare are completely end-of-life and have absolute no support.<BR /> Below is an explanation and possible root cause. That is all we can give you on this platform.<BR /> <BR /> My best guess is that a reboot will solve this.<BR /> <BR /> This is being created by the source-IP-lockdown feature. <BR /> So why are we trying to create a source-ip-lockdown ACL? My guess is they used to have source-ip-lockdown enabled and then disabled it. Now something remains in memory that is causing us to think it is still enabled. So when we create the DHCP Client Address on a port we go through this error and fail. <BR /> <BR /> This is reported by addDhcpClientAddr. He logs this right after he calls createSrcIPGuardACL and fails.<BR /> 03/01/2017 14:31:23.61 <KERN> ERROR in creating ACL for Addr:10.2.244.225, Port: 4095 <BR /> <BR /> This is from createSrcIPGuardACL after he calls ipStaticRuleAdd and receives a failure.<BR /> 03/01/2017 14:31:23.61 <KERN> Error in creation of IP ACL for IPAddr: 10.2.244.225,Port: X96<BR /> <BR /> This is reported by ipStaticRuleAdd of course and which is what kicks off this whole mess.<BR /> 03/01/2017 14:31:23.61 <SYST> ipStaticRuleAdd: Error creating Rule SrcIPGuard-0<BR /> <BR /> I think this error is being triggered by DHCP traffic. And my guess is we have an issue somewhere in either "addDhcpClientAddr" or the function calling it. <BR /> Again, we will not do any further investigation, you may check the settings for source-IP-lockdown.<BR /> <BR /></SYST></KERN></KERN> Thu, 02 Mar 2017 15:24:00 GMT Ron_Huygens 2017-03-02T15:24:00Z https://community.extremenetworks.com/t5/end-of-service-products/rule-srcipguard/m-p/22370#M186 Image : Extremeware Version 7.8.4.1 [non-ssh] [base] by Build_Master on 03/18/11 05:48:45<BR /> <BR /> BootROM : 8.2<BR /> 7i<BR /> <BR /> This started appearing in the logs <BR /> <BR /> 03/01/2017 14:31:23.61 <KERN> ERROR in creating ACL for Addr:10.2.244.225, Port: 4095<BR /> 03/01/2017 14:31:23.61 <KERN> Error in creation of IP ACL for IPAddr: 10.2.244.225,Port: X96<BR /> 03/01/2017 14:31:23.61 <SYST> ipStaticRuleAdd: Error creating Rule SrcIPGuard-0<BR /> <BR /> More examples:<BR /> <BR /> 02/28/2017 09:24:05.55 <KERN> ERROR in creating ACL for Addr:10.2.244.218, Port: 4095<BR /> 02/28/2017 09:24:05.55 <KERN> Error in creation of IP ACL for IPAddr: 10.2.244.218,Port: X96<BR /> 02/28/2017 09:24:05.55 <SYST> ipStaticRuleAdd: Error creating Rule SrcIPGuard-0<BR /> 02/28/2017 08:29:31.56 <KERN> ERROR in creating ACL for Addr:10.2.245.79, Port: 4095<BR /> 02/28/2017 08:29:31.56 <KERN> Error in creation of IP ACL for IPAddr: 10.2.245.79,Port: X96<BR /> 02/28/2017 08:29:31.56 <SYST> ipStaticRuleAdd: Error creating Rule SrcIPGuard-0<BR /> 02/28/2017 07:34:17.57 <KERN> ERROR in creating ACL for Addr:10.2.245.148, Port: 4095<BR /> 02/28/2017 07:34:17.57 <KERN> Error in creation of IP ACL for IPAddr: 10.2.245.148,Port: X96<BR /> 02/28/2017 07:34:17.57 <SYST> ipStaticRuleAdd: Error creating Rule SrcIPGuard-0<BR /> 02/28/2017 07:01:07.56 <KERN> ERROR in creating ACL for Addr:10.2.245.125, Port: 4095<BR /> 02/28/2017 07:01:07.56 <KERN> Error in creation of IP ACL for IPAddr: 10.2.245.125,Port: X96<BR /> 02/28/2017 07:01:07.56 <SYST> ipStaticRuleAdd: Error creating Rule SrcIPGuard-0<BR /> 02/27/2017 12:09:10.74 <KERN> ERROR in creating ACL for Addr:10.2.244.203, Port: 4095<BR /> 02/27/2017 12:09:10.74 <KERN> Error in creation of IP ACL for IPAddr: 10.2.244.203,Port: X96<BR /> 02/27/2017 12:09:10.74 <SYST> ipStaticRuleAdd: Error creating Rule SrcIPGuard-0<BR /> <BR /> Secondary question, why would you want the ipfdb ageing time set to never age out? And is the ipfdb table the equivalent of sh mac-address in other worlds?<BR /> <BR /> ty<BR /> <BR /></SYST></KERN></KERN></SYST></KERN></KERN></SYST></KERN></KERN></SYST></KERN></KERN></SYST></KERN></KERN></SYST></KERN></KERN> Thu, 02 Mar 2017 11:54:00 GMT https://community.extremenetworks.com/t5/end-of-service-products/rule-srcipguard/m-p/22370#M186 Jimmy_Sands 2017-03-02T11:54:00Z https://community.extremenetworks.com/t5/end-of-service-products/rule-srcipguard/m-p/22371#M187 The Summit 7i and ExtremeWare are completely end-of-life and have absolute no support.<BR /> Below is an explanation and possible root cause. That is all we can give you on this platform.<BR /> <BR /> My best guess is that a reboot will solve this.<BR /> <BR /> This is being created by the source-IP-lockdown feature. <BR /> So why are we trying to create a source-ip-lockdown ACL? My guess is they used to have source-ip-lockdown enabled and then disabled it. Now something remains in memory that is causing us to think it is still enabled. So when we create the DHCP Client Address on a port we go through this error and fail. <BR /> <BR /> This is reported by addDhcpClientAddr. He logs this right after he calls createSrcIPGuardACL and fails.<BR /> 03/01/2017 14:31:23.61 <KERN> ERROR in creating ACL for Addr:10.2.244.225, Port: 4095 <BR /> <BR /> This is from createSrcIPGuardACL after he calls ipStaticRuleAdd and receives a failure.<BR /> 03/01/2017 14:31:23.61 <KERN> Error in creation of IP ACL for IPAddr: 10.2.244.225,Port: X96<BR /> <BR /> This is reported by ipStaticRuleAdd of course and which is what kicks off this whole mess.<BR /> 03/01/2017 14:31:23.61 <SYST> ipStaticRuleAdd: Error creating Rule SrcIPGuard-0<BR /> <BR /> I think this error is being triggered by DHCP traffic. And my guess is we have an issue somewhere in either "addDhcpClientAddr" or the function calling it. <BR /> Again, we will not do any further investigation, you may check the settings for source-IP-lockdown.<BR /> <BR /></SYST></KERN></KERN> Thu, 02 Mar 2017 15:24:00 GMT https://community.extremenetworks.com/t5/end-of-service-products/rule-srcipguard/m-p/22371#M187 Ron_Huygens 2017-03-02T15:24:00Z