Introduction
This document describes this syslog message on the Nexus platform: L2FM-4-L2FM_MAC_MOVE
2016 Jan 12 15:19:53 N7K-1 %L2FM-4-L2FM_MAC_MOVE: Mac 0050.5695.1ac8 in vlan 150 has moved from Po6 to Po5
2016 Jan 12 15:19:56 N7K-1 %L2FM-4-L2FM_MAC_MOVE: Mac 0050.5695.3ba5 in vlan 150 has moved from Po5 to Po6
Problem : N7K-1 reports mac address 0050.5695.1ac8 and 0050.5695.3ba5 moves or has moved between two seperate interfaces (port-channel 5 and port-channel 6).
Solution
This log message is designed to alert the user that the switch receives packets from the same host (source mac) on two different interfaces in the same vlan.
Common triggers
- L2 loop
- Wireless Clients roaming between Access Points
- Vmotion
- Misconfigured Active/Standby NIC Teaming
When this log message is printed, these steps can be followed to track the source of the move:
- Document the interfaces which report the mac movement.
- Log into the device that attaches to these interfaces and enable mac move notification there if not already enabled.
- Continue this logic until you are able to track down the source of the mac move.
Command to enable mac move notification:
- IOS: mac address table notification mac-move
- N3K: mac address table notification mac-move ; logging level fwm 6 ; logging monitor 6
- N4K: mac address table notification mac-move ; logging level fwm 6 ; logging monitor 6
- N5K/N6K: mac address table notification mac-move ; logging level fwm 6; logging monitor 6
- N7K/N9K: logging level l2fm 5
These commands are non intrusive and they only print additonal syslog messages which pertain to mac flaps.
Related Information