Friday, April 18, 2014

L2 security – storm control.

Storm control is a security feature that protects network against packet flood. You can monitor unicast, broadcast and multicast packets. There are three measure methods: traffic rate: pps – packet per second, bps – bit per second, and percentage of interface bandwidth. You can define two actions which will be triggered once the storm occurs: shutdown or trap. Let’s do some tests on the following scenario:

 
            both switch port access vlan1 

                   Fa1/0/9   Fa1/0/11           
          /----\      \  ----- /       /----\ 
         |  R1  |-------| sw1 |-------|  R2  |
          \----/\        -----        /\----/ 
               Gig0/0             Gig0/0
              10.0.0.1           10.0.0.2     


a) Storm control for unicast:

On both ports of sw1 we enable storm control with limit of 5 packets per second:
  
MP-SW(config-if-range)#storm-control unicast level pps 5

and action:
  
MP-SW(config-if-range)#storm-control action shutdown

for action ‘shutdown’ we have to configure ‘errdisable recovery’:
  
MP-SW(config)#errdisable recovery cause storm-control
MP-SW(config)#errdisable recovery interval 30

Now on both interfaces we have following settings:
  
!
interface FastEthernet1/0/9
 description to R1-2911 gi0/0
 switchport mode access
 storm-control unicast level pps 5
 storm-control action shutdown
end
!
interface FastEthernet1/0/11
 description to R2-2911 gi0/0
 switchport mode access
 storm-control unicast level pps 5
 storm-control action shutdown
end
!
errdisable recovery cause storm-control
errdisable recovery interval 30
!

Let’s try how the storm control works:

r2#ping 10.0.0.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
r2#
 
for normal traffic we can’t see any disruption. Let’s increase the number of packet to 6 (the limit is 5):
 
r2#ping 10.0.0.1 repeat 6

Type escape sequence to abort.
Sending 6, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
!!!!!!
Success rate is 100 percent (6/6), round-trip min/avg/max = 1/1/4 ms
r2#
 
Now on sw1 we can see the storm control in action:
 
MP-SW#
*Mar  2 01:16:19.845: %PM-4-ERR_DISABLE: storm-control error detected on Fa1/0/9, putting Fa1/0/9 in err-disable state
*Mar  2 01:16:19.870: %STORM_CONTROL-3-SHUTDOWN: A packet storm was detected on Fa1/0/9. The interface has been disabled.
*Mar  2 01:16:19.870: %PM-4-ERR_DISABLE: storm-control error detected on Fa1/0/11, putting Fa1/0/11 in err-disable state
*Mar  2 01:16:20.868: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/9, changed state to down
*Mar  2 01:16:20.893: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/11, changed state to down
*Mar  2 01:16:21.875: %LINK-3-UPDOWN: Interface FastEthernet1/0/9, changed state to down
*Mar  2 01:16:21.900: %LINK-3-UPDOWN: Interface FastEthernet1/0/11, changed state to down
 
As we can see above, both interfaces detected storm and shut down their ports. After 30 sec we can see err-disable recovery attempts:

*Mar  2 01:16:49.867: %PM-4-ERR_RECOVER: Attempting to recover from storm-control err-disable state on Fa1/0/9
*Mar  2 01:16:49.893: %PM-4-ERR_RECOVER: Attempting to recover from storm-control err-disable state on Fa1/0/11
*Mar  2 01:16:53.634: %LINK-3-UPDOWN: Interface FastEthernet1/0/9, changed state to up
*Mar  2 01:16:53.667: %LINK-3-UPDOWN: Interface FastEthernet1/0/11, changed state to up
*Mar  2 01:16:54.641: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/9, changed state to up
*Mar  2 01:16:54.674: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/11, changed state to up


And now both interfaces are up.

b) Storm control for broadcast

Let’s remove the unicast storm control on Fa1/0/11 and set up it for broadcast with limit of 6 packets per second:
 
MP-SW(config-if)#storm-control broadcast level pps 6


We ping now R1 sending 5 packets (below both limits):
 
r2#ping 255.255.255.255

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 255.255.255.255, timeout is 2 seconds:
.
Reply to request 1 from 10.0.0.1, 1 ms
Reply to request 2 from 10.0.0.1, 1 ms
Reply to request 3 from 10.0.0.1, 1 ms
Reply to request 4 from 10.0.0.1, 1 ms
r2# 


now we increase the number of packets to 6 and ensure we send all packet in 1 sec:
 
r2#ping 255.255.255.255 repeat 6 timeout 0

Type escape sequence to abort.
Sending 6, 100-byte ICMP Echos to 255.255.255.255, timeout is 0 seconds:
......
r2#


on the switch we can see the port Fa1/0/9 is shut down:
 
MP-SW#
*Mar  2 01:33:16.821: %PM-4-ERR_DISABLE: storm-control error detected on Fa1/0/9, putting Fa1/0/9 in err-disable state
*Mar  2 01:33:16.846: %STORM_CONTROL-3-SHUTDOWN: A packet storm was detected on Fa1/0/9. The interface has been disabled.
*Mar  2 01:33:17.852: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/9, changed state to down
*Mar  2 01:33:18.851: %LINK-3-UPDOWN: Interface FastEthernet1/0/9, changed state to down


It means the unicast storm control detected storm control error. It was caused by icmp echo-reply from R1 to R2. The broadcast limit wasn’t exceeded and the port is working fine. Let’s increase the number to 7:
 
r2#ping 255.255.255.255 repeat 7 timeout 0

Type escape sequence to abort.
Sending 7, 100-byte ICMP Echos to 255.255.255.255, timeout is 0 seconds:
.......
r2#


on the switch we see that ports gig1/0/9 and gig1/0/11 detected storm:
 
MP-SW#
*Mar  2 01:38:42.903: %PM-4-ERR_DISABLE: storm-control error detected on Fa1/0/9, putting Fa1/0/9 in err-disable state
*Mar  2 01:38:42.928: %STORM_CONTROL-3-SHUTDOWN: A packet storm was detected on Fa1/0/9. The interface has been disabled.
*Mar  2 01:38:43.129: %PM-4-ERR_DISABLE: storm-control error detected on Fa1/0/11, putting Fa1/0/11 in err-disable state
*Mar  2 01:38:43.926: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/9, changed state to down
*Mar  2 01:38:44.153: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/11, changed state to down
*Mar  2 01:38:44.933: %LINK-3-UPDOWN: Interface FastEthernet1/0/9, changed state to down
*Mar  2 01:38:45.151: %LINK-3-UPDOWN: Interface FastEthernet1/0/11, changed state to down


On the port gig1/0/11 storm control detected broadcast storm and on the port gig1/0/9 echo-reply triggered unicast storm control. After 30 seconds both ports were recovered:


*Mar  2 01:39:12.925: %PM-4-ERR_RECOVER: Attempting to recover from storm-control err-disable state on Fa1/0/9
*Mar  2 01:39:13.152: %PM-4-ERR_RECOVER: Attempting to recover from storm-control err-disable state on Fa1/0/11
*Mar  2 01:39:16.625: %LINK-3-UPDOWN: Interface FastEthernet1/0/9, changed state to up
*Mar  2 01:39:16.868: %LINK-3-UPDOWN: Interface FastEthernet1/0/11, changed state to up
*Mar  2 01:39:17.631: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/9, changed state to up
*Mar  2 01:39:17.875: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/11, changed state to up


c) Storm control for unicast/broadcast and bps:

Let’s set up a new limit for 1000000 bps (bit per second):
 
!
interface FastEthernet1/0/9
 storm-control unicast level bps 1m
 storm-control action shutdown

and send some traffic:
 
r2#ping 10.0.0.1 size 10000 timeout 0 repeat 100

Type escape sequence to abort.
Sending 100, 10000-byte ICMP Echos to 10.0.0.1, timeout is 0 seconds:
......................................................................
..............................
Success rate is 0 percent (0/100)
r2#

we can enable debug storm detection to see number of bytes passing through the interface:
 
MP-SW#debug storm-control detection
 
And we can notice:


*Mar  2 01:58:16.888: storm_detect_and_control:I/F: Fa1/0/9, elapsed time = 1006, bytes = 1038600, packets = 700,  normalized rate = 8259244
*Mar  2 01:58:16.888: %PM-4-ERR_DISABLE: storm-control error detected on Fa1/0/9, putting Fa1/0/9 in err-disable state
*Mar  2 01:58:16.913: %STORM_CONTROL-3-SHUTDOWN: A packet storm was detected on Fa1/0/9. The interface has been disabled.
*Mar  2 01:58:17.912: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/9, changed state to down


Useful commands:


MP-SW#sh storm-control broadcast 
Interface  Filter State   Upper        Lower        Current
---------  -------------  -----------  -----------  ----------
Fa1/0/11   Forwarding           6 pps        6 pps        0 pps

MP-SW#sh storm-control unicast 
Interface  Filter State   Upper        Lower        Current
---------  -------------  -----------  -----------  ----------
Fa1/0/9    Forwarding          1m bps       1m bps        0 bps
MP-SW#
 

No comments:

Post a Comment