%DATAPLANE-4-NDPOISON

[tomsien]

Hello,

I keep receiving messages like this:

%DATAPLANE-4-NDPOISON: DAD or NA to DAD:  match existing snoop IP and MAC :Ethernet Src Mac: C8-14-51-10-EE-A4, Ethernet Dst Mac: 33-33-00-00-00-01, ND Src IP: fe80:0:0:0:ca14:51ff:fe10:eea4, ND Target IP: fe80:0:0:0:ca14:51ff:fe10:eea4, Snoop Table MAC = 00-00-00-00-00-00, Snoop Table IP = fe80:0:0:0:ca14:51ff:fe10:eea4.

%DATAPLANE-4-NDPOISON: DAD detection :  match existing snoop IP and MAC :Ethernet Src Mac: 00-00-00-FF-E7-B3, Ethernet Dst Mac: C8-D0-83-34-60-01, ND Src IP: 0:0:0:0:0:0:0:0, ND Target IP: fe80:0:0:0:444:cd39:a49e:e1d0, Snoop Table MAC = C8-D0-83-34-60-01, Snoop Table IP = fe80:0:0:0:444:cd39:a49e:e1d0.

I don’t use any IPv6 features, I don’t know what can be the problem. Please help

[ckelly]

tomsien,

Disable ALL of the DoS events in the firewall policy (best practice).  Though I haven’t seen this one in particular, I frequently see others...even in my own lab.

[vanelm]

Hi,

  Than I could recommend to follow best practices guide to filter out everything except ipv4, arp and (optionally) mint on affected interfaces using predefined l3 and l2 ACLs. On top of solving this particular issue it's also increase available airtime.

Regards,

  Misha

[tomsien]

I disabled almost everything 

firewall-policy default            
 no ip dos tcp-sequence-past-window
 no ipv6 unknown-options           
 no ipv6 duplicate-options         
 no proxy-nd                       
!                                  
!                                  

Still got this messages. The weird thing is that this messages only occurs on 3 AP located in the same location. I also have ~50 AP located in diffrent locations with the same configuration and there, the problem doesnt exist.

[vanelm]

Hello,

firewall-policy default

 no ipv6 …

Regards,

  Misha