1. Home
  2. Cisco Systems
  3. %SPANTREE-7-BLOCK_PORT_TYPE:

%SPANTREE-7-BLOCK_PORT_TYPE:

We have a core 4506 switch with 2 WS-X4306-GB and a supervisor II+. All distribution switches connect via fiber to the GBIC slots. On one GBIC slot, the fiber goes to a netscreen firewall. the firewall has a GBIC module as well. They are all SX modules. When I connect the fiber to the firewall, I gte this error in sh logging on the 4506:

%SPANTREE-7-RECV_1Q_NON_TRUNK: Received 802.1Q BPDU on non trunk GigabitEthernet2/2 VLAN1.

000133: Mar 5 13:27:55 UTC: %SPANTREE-7-BLOCK_PORT_TYPE: Blocking GigabitEthernet2/2 on VLAN0001. Inconsistent port type.

I am only using VLAN1 but have configured all GBIC ports as trunk ports as I will be creating more vlans in the future.

\\Any idea how I should configure this particular port to work with the firewall?

On all other uplink ports I have the cisco switch macro applied except this port

Thanks

Reply to
tony
Loading thread data ...

Hello,

There's a problem in a spanning-tree between your fw and Cat4k.

I don't know if NetScreen firewall supports VLANs on its ports, and if yes - you should also configure Trunk on your Gi2/2 port - because your NetScreen is obviously sending BPDU messages which are part of STP protocol. Check your status on Gi2/2, you may have some bpdu filtering or bpdu guard actived there, because you configured your port with macro configuration - and it automatically adds those security features.

regards, h.

Reply to
Havoc 25

I tried to configure this port as a trunk too here are the errors

000155: Mar 6 12:17:30 UTC: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan id 660 on GigabitEthernet2/2 VLAN1. 000156: Mar 6 12:17:30 UTC: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet2/2 on VLAN0001. Inconsistent local vlan. 000157: Mar 6 12:18:22 UTC: %SYS-5-CONFIG_I: Configured from console by suseadmin on vty0 000158: Mar 6 12:18:24 UTC: %SPANTREE-2-RECV_BAD_TLV: Received SSTP BPDU with bad TLV on GigabitEthernet2/2 VLAN1.

There is nt much on the netscreen side i can configure as far as vlans and trunks. By default that interfasce is already on vlan1

Reply to
tony

Do you have on NetScreen port VLAN 660, and locally on Cat4K you don't have that Vlan defined?

Check your Gi2/2 status with sh int gi2/2 switchport

regards, H.

Reply to
Havoc 25

Reply to
tony

The vlan660 is actually from the other side of the firewall to the gateway or router device I dont have access to. The reason I am seeing it I guess is because the firewall is configured in transparent mode. I also set both interfaces on my firewall to trunk interfaces and no luck.

Reply to
tony

Reply to
tony

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.