Storm Control HowTo
About
This document provides basic storm control use-cases, and how they are configured using the CLI.
For an overview of all available configuration settings for storm control refer to the port configuration guide:
Storm control utilises port error states when a storm is detected which will operatively disable the port, whilst still keeping the port administratively up. For more information regarding port error states, refer to the error state section in the port configuration guide:
Introduction
A broadcast storm can occur when a device in the network sends excessive broadcast, multicast, or unknown-unicast traffic, or when a loop forms in the network topology. This can quickly congest the link bandwidth and consume switch resources, effectively bringing down the entire network segment.
Storm control works by combining an ingress rate limit with automatic port error-disable. When the ingress rate on a port exceeds the configured threshold for the selected traffic type, the port is placed into an error state, stopping the offending traffic from propagating through the network. The port can either recover automatically after a configurable timeout or require manual intervention to bring it back up.
.---------.
| |
| Server |
| |
'----+----'
| eth6
.-------. .-----+-----. .-------.
| | eth4 | | eth5 | |
| H1 +-------------+ S1 +-------------+ H2 |
| | | | | |
'-------' '-----+-----' '-------'
| eth3
|
.--.-.
( ( )___
(_, \ ) ,_)
'-'--`--'
Untrusted Network
Figure 1: Switch S1 with an untrusted network segment on eth3 where a broadcast storm could originate.
In the example above, switch S1 connects trusted hosts on eth4 and eth5, a server on eth6, and an untrusted network segment on eth3. A misbehaving device on the untrusted segment could generate a broadcast storm that would flood all other ports. To protect the network, we configure storm control on eth3 so that the port is automatically disabled if excessive broadcast traffic is detected.
Example 1: Storm control with automatic recovery
In this example, we configure an ingress rate limit of 10 Mbit/s for broadcast traffic on eth3 and enable storm control with a 30-second timeout. If the broadcast rate exceeds 10 Mbit/s, the port is placed into an error state and automatically recovers after 30 seconds.
S1:/#> configure
S1:/config/#> port eth3
S1:/config/port-eth3/#> rate-limit
S1:/config/port-eth3/rate-limit/#> ingress bps 10M match bc
S1:/config/port-eth3/rate-limit/#> storm-control timeout 30
S1:/config/port-eth3/rate-limit/#> leave
S1:/#>With this configuration, when a broadcast storm on eth3 exceeds 10 Mbit/s the port is placed into an error state. After 30 seconds the error state is cleared and the port returns to normal operation. If the storm is still present, the port will be error-disabled again.
Example 2: Storm control with manual recovery
In some environments it may be preferable to keep the offending port disabled until an operator has investigated the issue. This is done by enabling storm control without a timeout.
Here we protect against both broadcast and unknown-unicast storms on eth3, with an ingress rate limit of 5 Mbit/s.
S1:/#> configure
S1:/config/#> port eth3
S1:/config/port-eth3/#> rate-limit
S1:/config/port-eth3/rate-limit/#> ingress bps 5M match bc,u-uni
S1:/config/port-eth3/rate-limit/#> storm-control
S1:/config/port-eth3/rate-limit/#> leave
S1:/#>When the threshold is exceeded the port enters an error state and stays there until the operator manually clears it.
S1:/#> port clear-error eth3
S1:/#>Alternatively, the port can be brought back up with:
S1:/#> port up eth3
S1:/#>Example 3: Protecting multiple ports
Storm control can be configured on multiple ports at once. In this example, all customer-facing ports (eth1 through eth3) are given an ingress rate limit of 1 Mbit/s for broadcast and multicast traffic, with a 60-second recovery timeout.
S1:/#> configure
S1:/config/#> port eth1..eth3
S1:/config/port-eth1..eth3/#> rate-limit
S1:/config/port-eth1..eth3/rate-limit/#> ingress bps 1M match bc,mc
S1:/config/port-eth1..eth3/rate-limit/#> storm-control timeout 60
S1:/config/port-eth1..eth3/rate-limit/#> leave
S1:/#>Verifying if storm control has triggered, and current configuration
To determine if the cause for the port being down is due to storm control
disabling the port, first use the show port command in the admin exec
context. Any link reporting Err-Disabled indicates that a WeOS service
has disabled the port.
S1:/#> show port
PORT LINK TYPE SPEED STATE OWNER/VLAN
eth1 Down N/A ---------- No-Link vlan U:1
eth2 Down N/A ---------- No-Link vlan U:1
eth3 Down 1000-T ---------- Err-Disabled vlan U:1
eth4 Up 1000-T 1000M-Full Forwarding vlan U:1
eth5 Up 1000-T 1000M-Full Forwarding vlan U:1
eth6 Up 1000-T 1000M-Full Forwarding vlan U:1
eth7 Down 1000-T ---------- No-Link vlan U:1
eth8 Down 1000-T ---------- No-Link vlan U:1
eth9 Down 1000-T ---------- No-Link vlan U:1
eth10 Down 1000-T ---------- No-Link vlan U:1To determine the exact cause for the port being rendered Err-Disabled, it
is possible to show a detailed view by using show port PORT. This view also
display the current configuration for the port.
S1:/#> show port eth3
eth3
Link : Down
Oper. status : Disabled
Admin status : Enabled
Description : eth3
Type : 1000-T
State : Err-Disabled
Alarm : N/A
VLAN : U:1
MAC : 00:07:7c:53:df:87
Autoneg : Enabled
Speed : -------------
Duplex :
MDI/MDIX :
MDI/MDIX status:
Polarity status:
Gbit-cu-master : auto
Fastlink : Disabled
Flow Control : Disabled
Prio mode : tag
Prio : 0
Ingress limit : 10000 kbps match bc
Egress limit : None
Storm Control : Enabled (timeout 60s)
Shielded mode : Unshielded
PHY power mode : Low power (CLASS B)
Bridge group : Disabled
Error State: Err-Disabled (effective)
STATE SERVICE REASON
Err-Disabled Storm Control Storm detectedEnabling rate-limit in your network may affect the performance of protocols and redundancy services dependent on the flow of management traffic, such as FRNT, MRP, and RSTP. If management traffic connected to these services start getting rate-limited their performance can not be guaranteed.
Disabling storm control
To remove storm control and the ingress rate limit from a port:
S1:/#> configure
S1:/config/#> port eth3
S1:/config/port-eth3/#> rate-limit
S1:/config/port-eth3/rate-limit/#> no storm-control
S1:/config/port-eth3/rate-limit/#> no ingress
S1:/config/port-eth3/rate-limit/#> leave
S1:/#>