blacklight's questions

I'm working on a rather small Layer 2 network segment that contains a physical loop. (I have included a picture of the topology below). The core switches are stacked 3850s. The other switches are SG300 series small business switches.

The links between all switches are trunks that allow vlans 1,503,508,590

Spanning-tree seems to be functioning as expected and the interface on SW3 that connects to SW4 is put into a blocking state.

The problem I have is that the core switch periodically logs a MAC Flap event between the links to SW1 and SW2.

%SW_MATM-4-MACFLAP_NOTIF: Host 00eb.d5f2.0b9a in vlan 1 is flapping between port Po1 and port Po2

The offending MAC address seems to be a Cisco MAC (Possible one assigned to a port group?) however I am unable to physically locate the switch to which it belongs. When I remove the loop, The Core says the MAC is available through Po2 (The link to SW2), however SW2 says the MAC is available through Po1 (The uplink to the Core).

My questions are:

• How can I determine which switch this MAC address actually belongs too?

• What might be causing this periodic flap between ports?

Here is the current configuration for all switch-to-switch links as well as a the full mac address table for each switch.

Core Switch interface configurations:

    interface GigabitEthernet1/1/1
     description Po1 Member1
     switchport trunk allowed vlan 1,503,508,590
     switchport mode trunk
     switchport nonegotiate
     channel-group 1 mode active
    end
    !
    interface GigabitEthernet1/1/2
     description Po2 Member1
     switchport trunk allowed vlan 1,503,508,590
     switchport mode trunk
     switchport nonegotiate
     channel-group 2 mode active
    end
    !
    interface GigabitEthernet2/1/1
     description Po1 Member2
     switchport trunk allowed vlan 1,503,508,590
     switchport mode trunk
     switchport nonegotiate
     channel-group 1 mode active
    end
    !
    interface GigabitEthernet2/1/2
     description Po2 Member2
     switchport trunk allowed vlan 1,503,508,590
     switchport mode trunk
     switchport nonegotiate
     channel-group 2 mode active
    end
    !
    interface Port-channel1
     description SW1 Uplink
     switchport trunk allowed vlan 1,503,508,590
     switchport mode trunk
     switchport nonegotiate
    end
    !
    interface Port-channel2
     description SW2 Uplink
     switchport trunk allowed vlan 1,503,508,590
     switchport mode trunk
     switchport nonegotiate
    end

SW1 interface configurations:

    interface gigabitethernet51
     channel-group 1 mode auto
    !
    interface gigabitethernet52
     channel-group 1 mode auto
    !
    interface Port-channel1
     description "Core Uplink"
     switchport trunk allowed vlan add 503,508,590
    !
    interface gigabitethernet50
     description "Uplink to SW3"
     switchport trunk allowed vlan add 503,508,590
    !

SW2 interface configurations:

    interface gigabitethernet51
     channel-group 1 mode auto
    !
    interface gigabitethernet52
     channel-group 1 mode auto
    !
    interface Port-channel1
     description "Core Uplink"
     switchport trunk allowed vlan add 503,508,590
    !
    interface gigabitethernet50
     description "Uplink to SW4"
     switchport trunk allowed vlan add 503,508,590
    !

SW3 interface configurations:

    interface gigabitethernet49
     description "UPLNK to SW4"
     switchport trunk allowed vlan add 503,508,590
    !
    interface gigabitethernet50
     description "UPLINK TO SW1"
     switchport trunk allowed vlan add 503,508,590
    !

SW4 interface configurations:

    interface gigabitethernet49
     description "UPLNK to SW3"
     switchport trunk allowed vlan add 503,508,590
    !
    interface gigabitethernet50
     description "UPLINK TO SW2"
     switchport trunk allowed vlan add 503,508,590
    !

Core Switch MAC Table for 00eb.d5f2.0b9a:

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    00eb.d5f2.0b9a    DYNAMIC     Po1

SW1 MAC Table for 00:eb:d5:f2:0b:9a:

    Vlan          Mac Address         Port       Type
------------ --------------------- ---------- ----------
     1         00:eb:d5:f2:0b:9a      gi50     dynamic

SW2 MAC Table for 00:eb:d5:f2:0b:9a:

    Vlan          Mac Address         Port       Type
------------ --------------------- ---------- ----------
     1         00:eb:d5:f2:0b:9a      Po1      dynamic
    503        00:eb:d5:f2:0b:9a      Po1      dynamic
    508        00:eb:d5:f2:0b:9a      Po1      dynamic
    590        00:eb:d5:f2:0b:9a      Po1      dynamic

SW3 MAC Table for 00:eb:d5:f2:0b:9a:

    Vlan          Mac Address         Port       Type
------------ --------------------- ---------- ----------

SW4 MAC Table for 00:eb:d5:f2:0b:9a:

    Vlan          Mac Address         Port       Type
------------ --------------------- ---------- ----------
     1         00:eb:d5:f2:0b:9a      gi50     dynamic
    503        00:eb:d5:f2:0b:9a      gi50     dynamic
    508        00:eb:d5:f2:0b:9a      gi50     dynamic
    590        00:eb:d5:f2:0b:9a      gi50     dynamic

show cdp nei for 'core switch':

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID

SW2
                 Gig 2/1/2         146              S I   SG300-52  gi52
SW2
                 Gig 1/1/2         146              S I   SG300-52  gi51
SW1
                 Gig 2/1/1         123              S I   SG300-52  gi52
SW1
                 Gig 1/1/1         123              S I   SG300-52  gi51

I have a Server 2008 R2 Domain with quite a few Group Policy Objects that should be applied to various OUs and security groups (Using security filtering).

I got reports from users that they were missing certain settings and things like mapped drives. When I started investigating the problem, I found that almost every single GPO in our domain has simply stopped being applied.

There are a few GPOs (Like the default domain policy) that are still being applied, and it looks like the one thing they have in common is that these policies are all applied to the 'Authenticated Users' builtin group. Whereas all other GPOs use security filtering on various other security groups.

I have run lots of RSOP tests (Planning and Logging) which both show that only the GPOs applied to 'Authenticated Users' are being run. The other GPOs don't even show up under the "GPOs that were not applied ..." section of gpresult. I have checked permissions, GPO inheritance, and a few other basic but common GPO problems, all of which seem fine. I tried creating a some brand new GPOs, and applying them to brand new security groups, however these were also not applied.

I have not noticed any other issues with Active Directory, authentication against these security groups for other functions (such as file permissions) all seem to be working as expected.

I'm at a total loss to explain why these GPOs just suddenly stopped getting applied, for no apparent reason. Does anyone have any ideas what might be going on, or how to continue troubleshooting?

I have a Windows Server 2008 R2 DNS server (that replicated to two other servers) with a zone called mycompany.com. I created a new subdomain for that zone called subdomain.mycompany.com, this subdomain contained a single SRV record and a single A record.

I then decided that I no longer needed this subdomain, so I deleted it. After deleting the subdomain I needed to create an A record within the original zone with the same name as the old deleted subdomain. (subdomain.mycompany.com). However instead of creating the A record within the original zone, the record is created inside of a new subdomain with the name of the original subdomain.

This works, however it is not the intended result. Any ideas why the new A record is causing the deleted subdomain to reappear?

EDIT: This behavior is repeatable, but ONLY if the deleted subdomain contains an SRV record. I have replicated the problem on Server 2012 R2 as well. It's almost as if the DNS Server thinks that the subdomain still exists, so it brings it back from the dead and places the new host record inside it, rather than just placing the host record in the parent zone.