Code: Select all
switch-sz(gi8) <--> (ether4)RB5009-bridge1-l2hw(ether3) <--> (gi1)switch-wz
Very happy with that so far, RB5009 bridge1 bridging, VLAN filtering, STP, IGMP and DHCP snooping is all working with l2hw offload at wirespeed. A big advantage over RB4011.
But we noticed the SG250 switches both issue warnings about detecting ingress LLDP packets from more than one source on gi8 resp. gi1.
Code: Select all
switch-sz# show lldp neighbors
Port Device ID Port ID System Name Capabilities TTL
--------- ----------------- ----------------- ----------------- ------------ -----
gi8 dc:2c:6e:45:d2:e3 bridge1/ether4 RB5009 B, R 75
gi8 b8:11:4b:1a:6f:4c gi1 switch-wz B 96
switch-wz# show lldp neighbors
Port Device ID Port ID System Name Capabilities TTL
--------- ----------------- ----------------- ----------------- ------------ -----
gi1 dc:2c:6e:45:d2:e3 bridge1/ether3 RB5009 B, R 117
gi1 b8:11:4b:1a:6a:40 gi8 switch-sz B 108
[admin@RB5009] > ip/neighbor/print
0 ether3 B8:11:4B:1A:6F:4D switch-wz
bridge1
1 ether4 B8:11:4B:1A:6A:48 switch-sz
bridge1
This problems can worked around by adapting the SG250 LLDP port configs.
But in genereal LLDP packets carry parameters specific to the physical egress port and hence should not be forwarded between switch/bridge ports. Especially if LLDP-MED comes into play, forwarding incoming LLDP between physical ports will cause confusion.
==============================
Edit:
Just figured out the easist work around is to use RB5009 switch rules:
Code: Select all
[admin@RB5009] /interface/ethernet/switch/rule> add switch=switch1 ports=ether3,ether4 mac-protocol=lldp copy-to-cpu=no redirect-to-cpu=yes mirror=no
Edit2:
It is further recommended to completly drop ingress LLDP on client access ports to avoid malicious device can mess with LLDP by sending LLDP reports.
Code: Select all
[admin@RB5009] /interface/ethernet/switch/rule> add switch=switch1 ports=ether2,ether5,ether6,ether7 mac-protocol=lldp copy-to-cpu=no redirect-to-cpu=no mirror=no new-dst-ports=""
Without those rules any client directly (or via dumb switch) connetced to l2hw enabled bridge port can send LLDP messages which will be forwarded to all bridge ports on the same VLAN...