Technical Tip: VLANs are switched on the wrong Cisco ports due to ifIndex values changing
Description
This article describes how to identify and fix issues where after a reboot of the switch, FortiNAC shows incorrect host location information. VLANs are consequently switched on the wrong ports.
Scope
FortiNAC.
Solution
The use of the ifIndex value is required in most switch vendors supported. The ifIndex value is a unique value that is associated with an interface and must remain consistent, otherwise, the appliance can lose track of interfaces.
This can result in the isolation of the switch or registered hosts connected to the switch.
As of Cisco version 12.1(5)T, Cisco does not persist information in the ifIndex table through a reboot by default.
To diagnose the issue perform the following.
- In Network Device -> Topology, locate the affected host and compare the port number to which it connects in Ports View to the MAC address table of the switch.
- Compare information received in Mac Notification trap to the Ports View.
Login to appliance CLI and filter for the affected MAC address in output.master file:
- FortiNAC (CentOS)
logs
nacdebug -name DeviceInterface true
nacdebug -name BridgeManager true
nacdebug -name TrapHandler true
tf output.master | grep -i CiscoMacNotification | grep -i "<x:x:x:x:x:x>" <----- Replace <x:x:x:x:x:x> with the actual MAC address.
- FortiNAC-F (NACOS):
diagnose debug plugin enable DeviceInterface
diagnose debug plugin enable BridgeManager
diagnose debug plugin enable TrapHandler
diagnose tail -F output.master | grep -i "<x:x:x:x:x:x>"<----- Replace <x:x:x:x:x:x> with the actual MAC address.
- Connect host to switch.
- Look for a message similar to the following:
CiscoMacNotification received for <switch name> <port number> {*host*} operation = ADD vlan = <vlanid> mac = <mac address> dot1dBasePort = <value> ifIndex = <value>
- Compare the information in the message to where the host shows connected under the Port View tab for that switch in Topology.
- The ifIndex value in the log message should match the Interface ID in the Ports view.
- The switch port number should also match.
- Ctrl-C to stop tail.
- Disable debugging:
- FortiNAC (CentOS)
logs
nacdebug -name DeviceInterface false
nacdebug -name BridgeManager false
nacdebug -name TrapHandler false
- FortiNAC-F (NACOS)
diagnose debug plugin disable DeviceInterface
diagnose debug plugin disable BridgeManager
diagnose debug plugin disable TrapHandler
- To fix duplicate ports or issues with port status out of sync follow the commands below:
- FortiNAC (CentOS)
logs
FixDupPorts -ip 'x.x.x.x' <----- eplace 'x.x.x.x' with the switch IP.
- FortiNAC-F (NACOS) v7.4.0 and greater:
diagnose network port advanced fix-duplicates ip
Usage: diagnose network port advanced fix-duplicates (ip <ip> | all | device-name <device-name> | group <group>)
ip <ip> IP Address of the device
all Perform action on all devices
device-name <device-name> Name of the device
group <group> Device Group Name
Usage: diagnose network port advanced fix-duplicates (ip <ip> | all | device-name <device-name> | group <group>)
ip <ip> IP Address of the device
all Perform action on all devices
device-name <device-name> Name of the device
group <group> Device Group Name
Workaround:
Restart management processes on the appliance to learn new mappings or reboot the appliance. To restart management processes in FortiNAC CLI:
- FortiNAC (CentOS)
logs
restartNAC
- FortiNAC-F (NACOS)
execute enter-shell
restartNAC
The following command must be added to the Cisco configuration to persist this information through a reboot:
snmp-server ifindex persist
For details on this command, refer to Cisco documentation, such as the following link:
Configuring SNMP IfIndex Persistence
Related article:
