topic Re: %DATAPLANE-4-NDPOISON in ExtremeWireless (WiNG)

%DATAPLANE-4-NDPOISON

tomsien — Thu, 30 Jan 2020 20:27:48 GMT

Hello,

I keep receiving messages like this:

%DATAPLANE-4-NDPOISON: DAD or NA to DAD: match existing snoop IP and MAC :Ethernet Src Mac: C8-14-51-10-EE-A4, Ethernet Dst Mac: 33-33-00-00-00-01, ND Src IP: fe80:0:0:0:ca14:51ff:fe10:eea4, ND Target IP: fe80:0:0:0:ca14:51ff:fe10:eea4, Snoop Table MAC = 00-00-00-00-00-00, Snoop Table IP = fe80:0:0:0:ca14:51ff:fe10:eea4.

%DATAPLANE-4-NDPOISON: DAD detection : match existing snoop IP and MAC :Ethernet Src Mac: 00-00-00-FF-E7-B3, Ethernet Dst Mac: C8-D0-83-34-60-01, ND Src IP: 0:0:0:0:0:0:0:0, ND Target IP: fe80:0:0:0:444:cd39:a49e:e1d0, Snoop Table MAC = C8-D0-83-34-60-01, Snoop Table IP = fe80:0:0:0:444:cd39:a49e:e1d0.

I don’t use any IPv6 features, I don’t know what can be the problem. Please help

Re: %DATAPLANE-4-NDPOISON

vanelm — Thu, 30 Jan 2020 20:54:39 GMT

Hello,

firewall-policy default

no ipv6 …

Regards,

Misha

Re: %DATAPLANE-4-NDPOISON

tomsien — Thu, 30 Jan 2020 21:16:55 GMT

I disabled almost everything

firewall-policy default
no ip dos tcp-sequence-past-window
no ipv6 unknown-options
no ipv6 duplicate-options
no proxy-nd
!
!

Still got this messages. The weird thing is that this messages only occurs on 3 AP located in the same location. I also have ~50 AP located in diffrent locations with the same configuration and there, the problem doesnt exist.

Re: %DATAPLANE-4-NDPOISON

vanelm — Thu, 30 Jan 2020 21:34:51 GMT

Hi,

Than I could recommend to follow best practices guide to filter out everything except ipv4, arp and (optionally) mint on affected interfaces using predefined l3 and l2 ACLs. On top of solving this particular issue it's also increase available airtime.

Regards,

Misha

Re: %DATAPLANE-4-NDPOISON

ckelly — Thu, 30 Jan 2020 22:27:26 GMT

tomsien,

Disable ALL of the DoS events in the firewall policy (best practice). Though I haven’t seen this one in particular, I frequently see others...even in my own lab.