Managed switch starts ARP storm after adding VLAN: likely misconfigured PIM/IGMP snooping combined with default VLAN flooding

Environment

Edge managed switch (vendor unspecified, CLI access available) connects multiple VLANs: management VLAN 10, IoT VLAN 20, user VLAN 30. After adding VLAN 40 for a new IoT segment and enabling trunk to core router, the switch reported 100% CPU and network outage for the /24 carrying IoT devices. Core router is a Linux-based router with iproute2, and multicast (IGMP snooping) enabled on switches.

Symptoms

Shortly after VLAN 40 creation and trunking, devices in VLAN 20 experienced severe packet loss and high latency. Switch CPU spiked to 100% and ARP table showed many duplicate entries. Observed ARP request storms flooding across multiple VLANs; some ports repeatedly showed flapping and broadcast storms. Disabling VLAN 40 trunking restored normal operation.

Observations

Switch logs: frequent "BPDU guard" and "MAC moving" messages. Show ip arp on router shows many ARP entries with the same MAC seen on multiple ports. Traceroutes from router to devices time out when switch CPU high. IGMP snooping was enabled on older configuration; when VLAN 40 added, IGMP querier configured on the switch collided with the router's querier causing multicast table churn. A misconfigured native VLAN on trunk port meant untagged frames belonging to management VLAN were being flooded into IoT VLAN 20. Packet captures on trunk show ARP requests with source VLAN 10 tags appearing on VLAN 20.

Already attempted

Removed VLAN 40 from trunk — network stabilized. Cleared MAC table and rebooted switch — temporarily resolved until VLAN40 was reintroduced. Attempted to disable IGMP snooping on VLAN 20 — reduced multicast churn but ARP storm persisted until native VLAN mismatch was fixed.

Question

What configuration changes should I make to prevent ARP/multicast storms when adding new VLANs and trunks on the managed switch, and how can I safely reintroduce VLAN 40 without causing another outage?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 1w ago• Trouble ID

Most likely causes

Native VLAN mismatch on trunk ports causing untagged management frames to leak into other VLANs. 95%

Incorrect VLAN membership on aggregation links or inconsistent VLAN trunking configuration between switch and router. 90%

IGMP snooping/querier misconfiguration creating multicast table instability and CPU load. 80%

Summary

Symptoms indicate VLAN tagging and trunk configuration mismatch combined with multicast/IGMP querier conflicts caused broadcast/ARP traffic to be forwarded incorrectly across VLANs, leading to MAC table churn and CPU exhaustion on the switch. The presence of untagged frames (native VLAN mismatch) likely allowed ARP traffic from management VLAN to be injected into IoT VLAN. IGMP snooping errors and multiple queriers accelerated table churn. The safe approach is to ensure trunk native VLAN is consistent, explicitly tag VLANs on trunks, align IGMP querier behavior, and add safeguards (BPDU/loop protection) before reintroducing VLANs.

Suggested Fixes

Diagnostic step 1

Before reintroducing VLAN 40, verify trunk port configuration on both switch and core router: ensure native VLAN is identical and explicit tagging is enabled for all user VLANs (avoid relying on untagged/native frames for critical VLANs).

Diagnostic step 2

Enable port-security or MAC sticky on access ports for IoT devices to limit MAC learning and reduce impact of flapping devices.

Diagnostic step 3

Review and align IGMP querier settings: designate a single IGMP querier (usually the router) and disable local querier on the switch for the affected VLANs, or configure static multicast memberships where possible.