MACFLAP_NOTIF Host X in vlan 1 is flapping between port G

[silvercas]

Hello,

Just today I noticied an interesting issue in my cisco 2960g logs. It appears one port is "flapping"

%SW_MATM-4-MACFLAP_NOTIF: Host X.X.X in vlan 1 is flapping between port Gi0/36 and port Gi0/37

once I disable the dell server on port 36 the flapping stops. Cisco is saying bad nic and dell is telling me to delete the nic and reload the drivers. The server is acting as WSUS, Anti-Virus MGMT, Web Filter

Anyone ever see this?

 

[VinceWhirlwind]

Is the server attached to both switchports?

 

[silvercas]

port 36 is the server and 37 is the ASA. though the same switch, port 38 I have a span to 37 for web filtering

 

[rustman]

I presume the nic's on the server are teamed?
Are the sw ports channel-grouped?

 

[silvercas]

nics arent teamed. one is just acting on a span port to monitor network traffic going over firewall lthe other is LIVE. disabling the span or live nic stops the issue

 

[VinceWhirlwind]

Check your MAC addresses - both in the switch mac-address-table as well as on the server.

 

[silvercas]

the product we are using for web filtering is causing the issue. the product has been discontinued. time to get a new product that works inline with the firewall

 

[VinceWhirlwind]

It's a while since I've been involved with web-filtering, but I remember WebSweeper and Websense being the best of the bunch I tried out.
A similar product but which is amazingly good value is called "Contentkeeper" - well worth looking into it.