Switchport BPDUs dropped at ASA firewall

cisco-asacisco-ios-12firewallswitch

I have stacked 2960X switches trunked to a single ASA 5515X in routed mode, and I've captured the drops with capture voip type asp-drop l2_acl after seeing the l2_acl counter incrementing in show asp drop.

Does the ASA support spanning-tree in routed mode? Should spanning-tree be disabled on the port-channel on the switch going to the firewall? Should I add bpdu rootguard to be safe? I either want the ASA to handle/ignore the BPDUs silently from the 2960X's or stop the switches from sending them, but add some loop protection.

ASA asp drop capture — first three packets shown matching BPDU MAC:

   1: 23:54:32.662502 5ca4.8a10.5e31 0100.0ccc.cccd 0x8100 Length: 68
      802.1Q vlan#11 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
   2: 23:54:32.662715 5ca4.8a10.5e31 0100.0ccc.cccd 0x8100 Length: 68
      802.1Q vlan#120 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
   3: 23:54:33.665386 5ca4.8a10.5e31 0100.0ccc.cccd 0x8100 Length: 68
      802.1Q vlan#10 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
   4: 23:54:33.666087 5ca4.8a10.5e31 0100.0ccc.cccd 0x8100 Length: 68
      802.1Q vlan#910 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop

Switchport relevant interface config:

interface GigabitEthernet1/0/49
 switchport access vlan 99
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10-99,120,910,911
 switchport mode trunk
 ip arp inspection trust
 logging event trunk-status
 logging event bundle-status
 logging event spanning-tree
 queue-set 2
 priority-queue out
 mls qos trust cos
 no lldp transmit
 no lldp receive
 channel-protocol lacp
 channel-group 10 mode active
 ip dhcp snooping trust
... [other phy int not shown] ...
interface Port-channel10
 description in.fw-kop-105-1
 switchport access vlan 99
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10-99,120,910,911
 switchport mode trunk
 ip arp inspection trust
 spanning-tree portfast trunk
 ip dhcp snooping trust

ASA relevant interface config:

interface GigabitEthernet0/2
 description g1-0-49.s-kop-105-1
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 description g2-0-49.s-kop-105-2
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface Port-channel10
 description gec10.s-kop-105-s1
 no nameif
 no security-level
 no ip address
!
interface Port-channel10.10
 vlan 10
 nameif Inside-am.data
 security-level 100
 ip address 10.x.1.1 255.255.255.0
... [remaining subint's not shown] ...

Best Answer

If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. This does not provide any loop protection, but the ASA (non-5505 as indicated) is incapable of creating a L2 loop and your stated goal is to remove BPDU's from the interface.

Configuring root-guard on the interface will not be useful since the ASA can never send any BPDU, and especially not a superior BPDU. If you do not choose to configure BPDU filtering, then BPDU-Guard should be configured either by default (spanning-tree portfast bpduguard default) or specifically on the interface. This will prevent any other spanning-tree capable device from being connected to that interface.

Further, if you do not have an untagged (native) interface on the firewall, allowing the native vlan on the trunk is not required and your allowed vlan list could be shortened to exclude 99. Also you could set the interface to not negotiate the access/trunking mode with switchport nonegotiate and remove the configured access vlan.

Related Topic