Detecting and preventing network loops
Systems, methods, and computer-readable storage media for detecting network loops. A system can identify, for each virtual tunnel endpoint (VTEP) from multiple VTEPs in a network, respective media access control address data including the respective local interface media access control addresses of the respective VTEP and respective media access control addresses learned by the respective VTEP. The system can determine whether the VTEPs are running spanning tree protocol (STP), and whether a media access control address learned by a first VTEP matches a respective local interface media access control address of a second VTEP. The system can detect a loop when the media access control address learned by the first VTEP matches the respective local interface media access control address of the second VTEP. The system can also detect a loop when the VTEPs are running STP and the first and second VTEPs see the same STP root bridge.
1. A method comprising:
identifying, for each virtual tunnel endpoint from a plurality of virtual tunnel endpoints in a network, respective media access control address data comprising at least one of respective local interface media access control addresses of the respective virtual tunnel endpoint and respective media access control addresses learned by the respective virtual tunnel endpoint;
determining whether the plurality of virtual tunnel endpoints are running spanning tree protocol;
based on the respective media access control address data, determining whether a media access control address learned by a first virtual tunnel endpoint from the plurality of virtual tunnel endpoints matches a respective local interface media access control address of a second virtual tunnel endpoint from the plurality of virtual tunnel endpoints;
detecting a first network loop when the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint; and
detecting a second network loop when:
the plurality of virtual tunnel endpoints is running spanning tree protocol; and
the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with a same spanning tree protocol root bridge.
2. The method of claim 1 , wherein the respective media access control address data is identified based on respective advertisements transmitted by each of the plurality of virtual tunnel endpoints in the network.
3. The method of claim 2 , wherein the respective media access control address data comprises a respective media access control table of the respective media access control addresses.
4. The method of claim 1 , further comprising:
determining whether the first virtual tunnel endpoint and the second virtual tunnel endpoint are virtual portchannel peers or multihoming peers; and
wherein detecting the first network loop and detecting the second network loop comprise determining that the first virtual tunnel endpoint and the second virtual tunnel endpoint are not virtual portchannel peers or multihoming peers.
5. The method of claim 1 , further comprising:
identifying a respective spanning tree protocol root bridge identifier for each virtual local area network associated with the respective virtual tunnel endpoint;
determining that the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with a same spanning tree protocol root bridge identifier; and
when the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with the same spanning tree protocol root bridge identifier, determining that the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with the same spanning tree protocol root bridge.
6. The method of claim 5 , further comprising:
based on the respective spanning tree protocol root bridge identifier, determining that a first one of the first virtual tunnel endpoint and the second virtual tunnel endpoint is a root bridge, to yield a root bridge determination; and
in response to detecting the first network loop or the second network loop, suspending, based on the root bridge determination, an associated virtual local area network on a second one of the first virtual tunnel endpoint and the second virtual tunnel endpoint.
7. The method of claim 5 , further comprising:
based on the respective spanning tree protocol root bridge identifier, determining that neither the first virtual tunnel endpoint nor the second virtual tunnel endpoint is a root bridge, to yield a root bridge determination; and
in response to detecting the first network loop or the second network loop, suspending, based on the root bridge determination, an associated virtual local area network on a root port of a particular virtual tunnel endpoint comprising either the first virtual tunnel endpoint or the second virtual tunnel endpoint.
8. The method of claim 5 , further comprising:
based on the respective media access control address data, determining that the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint; and
in response to determining that the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint, detecting the first network loop.
9. The method of claim 8 , further comprising:
determining that the plurality of virtual tunnel endpoints are not running spanning tree protocol; and
in response to detecting the first network loop and determining that the plurality of virtual tunnel endpoints are not running spanning tree protocol suspending a virtual local area network associated with a particular interface of the first virtual tunnel endpoint, on which the first virtual tunnel endpoint learned the media access control address that matches the respective local interface media access control address of the second virtual tunnel endpoint.
10. The method of claim 9 , further comprising:
selecting, based on respective internet protocol addresses of the first virtual tunnel endpoint and the second virtual tunnel endpoint, a specific virtual tunnel endpoint from the first virtual tunnel endpoint and the second virtual tunnel endpoint on which to suspend the virtual local area network, the specific virtual tunnel endpoint being selected based on a determination that the specific virtual tunnel endpoint is associated with a lowest internet protocol address from the respective internet protocol addresses; and
suspending the virtual local area network on one or more interfaces associated with the specific virtual tunnel endpoint selected.
11. The method of claim 1 , further comprising:
obtaining, via a controller on the network, the respective media access control address data from respective media access control address advertisements flooded on the network by each respective virtual tunnel endpoint from the plurality of virtual tunnel endpoints; and
wherein the advertisements are flooded on the network via Ethernet virtual private network.
12. A system comprising:
one or more processors; and
a computer-readable medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
identifying, for each virtual tunnel endpoint from a plurality of virtual tunnel endpoints in a network, respective media access control address data comprising at least one of respective local interface media access control addresses of the respective virtual tunnel endpoint and respective media access control addresses learned by the respective virtual tunnel endpoint;
determining whether the plurality of virtual tunnel endpoints are running spanning tree protocol;
based on the respective media access control address data, determining whether a media access control address learned by a first virtual tunnel endpoint from the plurality of virtual tunnel endpoints matches a respective local interface media access control address of a second virtual tunnel endpoint from the plurality of virtual tunnel endpoints;
detecting a first network loop when the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint; and
detecting a second network loop when:
the plurality of virtual tunnel endpoints is running spanning tree protocol; and
the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with a same spanning tree protocol root bridge.
13. The system of claim 12 , wherein the computer-readable medium stores additional instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
identifying a respective spanning tree protocol root bridge identifier for each virtual local area network associated with the respective virtual tunnel endpoint;
determining that the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with a same spanning tree protocol root bridge identifier; and
when the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with the same spanning tree protocol root bridge identifier, determining that the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with the same spanning tree protocol root bridge.
14. The system of claim 13 , wherein the computer-readable medium stores additional instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
based on the respective spanning tree protocol root bridge identifier, determining that a first one of the first virtual tunnel endpoint and the second virtual tunnel endpoint is a root bridge, to yield a root bridge determination; and
in response to detecting at least one of the first network loop and the second network loop, suspending, based on the root bridge determination, an associated virtual local area network on a second one of the first virtual tunnel endpoint and the second virtual tunnel endpoint.
15. The system of claim 13 , wherein the computer-readable medium stores additional instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
based on the respective spanning tree protocol root bridge identifier, determining that neither the first virtual tunnel endpoint nor the second virtual tunnel endpoint is a root bridge, to yield a root bridge determination; and
in response to detecting the first network loop and the second network loop, suspending, based on the root bridge determination, an associated virtual local area network on a root port of a particular virtual tunnel endpoint comprising either the first virtual tunnel endpoint or the second virtual tunnel endpoint.
16. The system of claim 13 , wherein the computer-readable medium stores additional instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
based on the respective media access control address data, determining that the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint;
in response to determining that the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint, detecting the first network loop;
determining that the plurality of virtual tunnel endpoints are not running spanning tree protocol; and
in response to detecting the first network loop and determining that the plurality of virtual tunnel endpoints are not running spanning tree protocol, suspending a virtual local area network associated with a particular interface of the first virtual tunnel endpoint, on which the first virtual tunnel endpoint learned the media access control address that matches the respective local interface media access control address of the second virtual tunnel endpoint.
17. The system of claim 16 , wherein the computer-readable medium stores additional instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
selecting, based on respective internet protocol addresses of the first virtual tunnel endpoint and the second virtual tunnel endpoint, a specific virtual tunnel endpoint from the first virtual tunnel endpoint and the second virtual tunnel endpoint on which to suspend the virtual local area network; and
suspending the virtual local area network on one or more interfaces associated with the specific virtual tunnel endpoint selected.
18. A non-transitory computer-readable medium having stored therein instructions which, when executed by one or more processors, cause the one or more processors to perform operations comprising:
identifying, for each virtual tunnel endpoint from a plurality of virtual tunnel endpoints in a network, respective media access control address data comprising at least one of all respective local interface media access control addresses of the respective virtual tunnel endpoint and respective media access control addresses learned by the respective virtual tunnel endpoint;
identifying a respective spanning tree protocol root bridge identifier for each virtual local area network associated with the respective virtual tunnel endpoint;
based on the respective spanning tree protocol root bridge identifier associated with each respective virtual tunnel endpoint, determining whether a first virtual tunnel endpoint and a second virtual tunnel endpoint are associated with a same spanning tree protocol root bridge identifier;
based on the respective media access control address data, determining whether a media access control address learned by the first virtual tunnel endpoint matches a respective local interface media access control address of the second virtual tunnel endpoint; and
detecting a network loop when at least one of:
the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with the same spanning tree protocol root bridge identifier; and
the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint.
19. The non-transitory computer-readable medium of claim 18 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
based on the respective spanning tree protocol root bridge identifier, determining that a first one of the first virtual tunnel endpoint and the second virtual tunnel endpoint is a root bridge, to yield a root bridge determination; and
in response to detecting the network loop, suspending, based on the root bridge determination, an associated virtual local area network on a second one of the first virtual tunnel endpoint and the second virtual tunnel endpoint.
20. The non-transitory computer-readable medium of claim 18 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
based on the respective spanning tree protocol root bridge identifier, determining that neither the first virtual tunnel endpoint nor the second virtual tunnel endpoint is a root bridge, to yield a root bridge determination; and
in response to detecting the network loop, suspending, based on the root bridge determination, an associated virtual local area network on a root port of a particular virtual tunnel endpoint comprising either the first virtual tunnel endpoint or the second virtual tunnel endpoint, the particular virtual tunnel endpoint being selected from between the first and second virtual tunnel endpoints based on a determination that the particular virtual tunnel endpoint has a lowest internet protocol address from between the first virtual tunnel endpoint and the second virtual tunnel endpoint.