Nexus: L2FM-4-L2FM_MAC_MOVE syslog explained

Introduction

This document describes this syslog message on the Nexus platform -

2016 Jan 12 15:19:53 N7K-1 %L2FM-4-L2FM_MAC_MOVE: Mac 0050.5695.1ac8 in vlan 150 has moved from Po6 to Po5
2016 Jan 12 15:19:56 N7K-1 %L2FM-4-L2FM_MAC_MOVE: Mac 0050.5695.3ba5 in vlan 150 has moved from Po5 to Po6

Problem : N7K-1 reports mac address 0050.5695.1ac8 and 0050.5695.3ba5 has moved or is moving between two seperate interfaces (port-channel 5 and port-channel 6).  

Solution

This log message is designed to alert the user that the switch is receving packets from the same host (source mac) on two different interfaces in the same vlan.

Common triggers

• L2 loop
• Wireless Clients roaming between Access Points
• Vmotion
• Misconfigured Active/Standby NIC Teaming

When this log message is printed, the following steps can be used to track the source of the move:

• Document the interfaces which are reporting the mac moving.
• Log into the device that attaches to these interfaces and enable mac move notification there if not already enabled.
• Follow this logic until you are able to track down the source of the mac move.

Command to enable mac move notification:

• IOS: mac address table notification mac-move
• N3K: mac address table notification mac-move ; logging level fwm 6 ; logging monitor 6
• N4K: mac address table notification mac-move ; logging level fwm 6 ; logging monitor 6
• N5K/N6K: mac address table notification mac-move ; logging level fwm 6; logging monitor 6
• N7K/N9K: logging level l2fm 5

These commands are non intrusive and will only print additonal syslog messages pertaining to mac flaps.

Related Information

• Nexus 5000 FAQ: What do you do when a Nexus 5000 switch displays the "FWM-2-STM_LOOP_DETECT" message in the log?
• Technical Support & Documentation - Cisco Systems