fdb mac move - how to look for the cause

[wsalkos]

hey, from time to time I have a problem with my vlan for cameras and generally for the BMS system.Today I lost access to several cameras on different sites again :

example log 

all mac moves go to the uplink port except for one switch which does mac move to the port where I also have cameras but behind the Ubiqity AP bridge (radio link). I had elrp on this port but it was disabled.

something must be going on in this vlan, but I don't know how to catch it.

I don't know if it's a loop. but I don't know how to verify it either. I may have provided too little information. but I will provide all the required information you need

[Gabriel_G · Accepted solution]

As Stefan mentioned, it sounds like you have some loop-like behavior.
If I had to bet, I'd say that your APs have a wireless backhaul bridge mode which is sending traffic in circles.
ELRP may or may not catch this depending on how the APs handle ELRP frames.

Regardless, my input would be this:
-I would expect that a given Camera MAC is learned on one port and one port only in your network; it is not like the cameras are actually moving.
-All 'show fdb <Camera MAC>' entries should point in the direction of where the camera is actually connected in the network.
-IE: Your core switch would show this MAC learned on a port towards an edge switch, an edge switch would show this MAC learned on the port where this camera is connected.
-If you are seeing a MAC move where a Camera MAC is being learned on a port that is not actually in the direction of the camera, that indicates that traffic from the camera is somehow coming into the switch from that port. You need to determine why.
-Go in the direction of where the MAC move is showing camera traffic incorrectly coming into the switch; add more MAC move logs as needed if the logs on one switch point to another switch.
-Continue this process of adding/checking MAC moves logs to find where traffic from the camera is unexpectedly coming into the wired network and figure out why camera traffic is coming into the network on that port.
-Based on your description, it sounds like camera traffic may be incorrectly coming into the switch from some other port where an AP is connected. That makes me think that the APs are looping traffic at times, possibly due to some wireless mesh backhaul setting.
-If the cameras are connected wireless to APs, MAC move logs can also occur when a client roams from one AP to another. This may be a side-effect of some other wireless issue occurring in your network which you'd need to investigate with appropriate subject matter experts.

MAC Move Logs:
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000079713

Hope that helps!

[Stefan_K_]

Sounds like a loop! Use ELRP to find out where 🙂