Physical Network Topology
As shown in the figure, two CE12800s are directly connected, and ICMP speed limit is configured on SwitchB. The command is as follows: icmp rate-limit interface 10GE 2/0/1 threshold 1
Figure 1-1 ICMP rate limit
Fault Description
When SwitchA pings SwitchB, the ICMP speed limit function does not take effect on SwitchB. The detailed information is as follows:
[CE12800_A]
ping 111.111.1.3
PING 111.111.1.3: 56 data bytes, press CTRL_C to break
Reply from 111.111.1.3: bytes=56 Sequence=1 ttl=254 time=1
ms
Reply from 111.111.1.3: bytes=56 Sequence=2 ttl=254 time=1
ms
Reply from 111.111.1.3: bytes=56 Sequence=3 ttl=254 time=1
ms
Reply from 111.111.1.3: bytes=56 Sequence=4 ttl=254 time=1
ms
Reply from 111.111.1.3: bytes=56 Sequence=5 ttl=254 time=1
ms
--- 111.111.1.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms
Normally, there should be ICMP loss-limited packet loss.
Configuration Files
l Confguration on SwitchA
#
interface Vlanif1111
ip address 111.111.1.1 255.255.255.0
interface 10GE1/0/1
port link-type trunk
port trunk allow-pass vlan 5 10 to 30 300 1111 3000
stp disable
device transceiver 10GBASE-COPPER
#
l Configuration on SwitchB
user-interface
con 0
#
user-interface vty 0 4
authentication-mode none
user privilege level 3
idle-timeout 0 0
protocol inbound telnet
#
vm-manager
#
return
1.1.2 Troubleshooting Location
Troubleshooting Procedure
Step 1 Check that SwitchB receives the ICMP packet normally and finds that the packet has been sent from the chip to the CPU.
<CE12800_B>
display cpu-defend statistics packet-type icmp slot 1/4
Statistics(packets) on slot 1/4 :
--------------------------------------------------------------------------------
PacketType
Total Passed Total
Dropped Last Dropping Time
Last 5 Min Passed Last 5 Min Dropped
--------------------------------------------------------------------------------
icmp 5
0 -
5
0
Step 2 Check whether the CPU receives ICMP packets and speed limit on the CPU.
<CE12800_B> debugging ip icmp
Step 3 After ICMP debugging is enabled, it is found that no ICMP is sent to the CPU to check whether the interface board fast returns ICMP packets.
<CE12800_B>
display icmp fast-reply statistics slot 1/4
------------------------ Display ICMP Statistics
-------------------------------
Received packets:
request
packets:
5
invalid request
packets:
0
failed to get vrf: 0
destination is not host
ip:
0
failed to get ctrl
word:
0
Send
packets:
successful reply
packets:
5
failed reply
packets:
0
--------------------------------------------------------------------------------
The display shows that ICMP packets are processed back by the interface and are not sent to the CPU of the main control board.
Step 4 Turn off the ICMP echo-reply fast function.
[CE12800_B] icmp echo-reply fast disable
Step 5 Verify on SwitchA as follows.
<CE12800_A>
ping 111.111.1.3
PING 111.111.1.3: 56 data bytes, press CTRL_C to break
Reply from 111.111.1.3: bytes=56 Sequence=1 ttl=255 time=15
ms
Request time out
Reply from 111.111.1.3: bytes=56 Sequence=3 ttl=255 time=2
ms
Request time out
Reply from 111.111.1.3: bytes=56 Sequence=5 ttl=255 time=1
ms
--- 111.111.1.3 ping statistics ---
5 packet(s) transmitted
3 packet(s) received
40.00% packet loss
round-trip min/avg/max = 1/6/15 ms
It has been verified that the ICMP speed limit function takes effect.
----End
Root Cause
The ICMP rate limit function is in conflict with the default ICMP rate limit function. The rate limit function does not take effect.
