Re: PortFast Question

["John R. Morris" <jrmorris () nerdality com>]

Josh Sukol wrote:

> I am running a small network using four Cisco Catalyst 2950 switches. 
> I am in the process of configuring a new software package that uses
> some proprietary hardware that connects to the  network via Ethernet. 
> When plugged into the network the device would connect for a minute or
> two and than connectivity would drop (i.e. ping would fail, and the
> light on the switch would turn from green to amber)  This pattern
> continued for as long as the device was plugged into the network.  The
> cabling was checked and tested with other equipment and there were no
> other problems.
>
> After trying several other things I eventually started changing the
> ethernet port settings on the switch itself and found that by enabling
> portfast the device functioned fine.  I have found very little
> information about port fast security issues.  I was able to find and
> did read up on PortFast BPDU guard and potential DoS using malformed
> packets.  Are there any other security issues that effect me enabling
> Portfast on specific ports that connect back to a single device?  Are
> there any other ways to solve this problem that might allow me to
> sidestep this potential security issues all together?
>
>  
The only potential  security problems are:
1 That the port you enable portfast on connects to a switch or hub which 
then gets connected back to your network, creating a loop and lots of 
problems...

2. Implementation flaws (usually DoS which you noted above already).


> - Slightly Off Topic - 
> If anyone knows why this behavior occurs and why enabling portfast
> fixes the connectivity issue I would be very interested to a hear an
> explanation.
>
>  
Ok, so what PortFast the wonder Cisco (TM) technology does is bypass 
SpanningTree (the nifty Layer 2 stuff that blocks loops in your network 
but still allows redundant connections (and when the active links goes 
down it switches on the blocked one if applicable, keeping things 
flowing on your network, even though part of it failed. So it protects 
against idiots who would create loops and uses your useful redundancies 
effectively.) normal mode of blocking, learning and then forwarding (for 
a host (or even, though it ain't recommended! a hub or switch of only 
hosts that is never going to get plugged in twice. Better to not enable 
portfast anytime you see multiple MACS from a port unless you know 
A>they're all from one machine B> you have absolute confidence/control 
of that hub or switch and will never run the risk of a loop) device). 
Essentially hosts devices PCs, printers, alien doodads with an ethernet 
jack, whatever like to forward their packets. Having 30 seconds or so 
where the packets are being blocked and MAC addresses learned and such 
is not useful. PortFast spares you that (obviously, the switch still 
sees the packets and learns the MAC address but without the safety first 
blocking of a potential loop). It's a good thing. Do it on all your host 
ports.

Other things to check with odd host connectivity include (but not 
limited to) duplex/speed mismatches between port and device, (some cards 
don't play well with Cisco's autodetection or vice versa, depending on 
your viewpoint), bad ethernet card, bad switchport (check the error 
counters), or bad OS kernel driver for the ethernet card (check for 
patches), cabling problems (test/replace/test).

Other cool technologies by Cisco such as VMPS toss the first packet (has 
to read it in order to assign the VLAN membership dynamically. Now why 
it can't store it and send it on after it does that beats me... Most 
hosts can tolerate losing their first packet as they come up. If not you 
can do things like embed a single ping command in the startup right 
after the network comes up so your lost packet is not of any 
consequence. There are tons of important things to know like Portfast to 
properly configure a switch for good performance and not giving you 
fits. You'll be surprised once you make those configuration changes how 
much better things work. Of course, then you have to keep copies of your 
no longer default configs and pretty soon you are sucked in deep into 
the world of networking.

Anyway, this is just off the hip, google will of course provide tons 
more reference on Portfast, Spanningtree and such. Better written than I 
could possibly manage, but the above is correct to the best of my memory.

HTH,
John "If you have a job for a sysadmin / network admin in North Carolina 
e-mail me" Morris