Managed switch VLAN addition triggers ARP storms and 100% CPU on switch, knocking a /24 offline

Environment

Small office: Cisco SG300 series managed switch running firmware 1.4.8. Core router is a pfSense box (2.5.2) with a single L3 interface for VLAN routing; affected hosts are on VLAN 20 (192.168.20.0/24).

Symptoms

After creating VLAN 20 and assigning several access ports, all hosts on 192.168.20.0/24 experienced intermittent connectivity with high latency (>500 ms) and packet loss; some hosts became unreachable. The problem started within 30 minutes of enabling the VLAN and persisted until the switch was rebooted.

Observations

Switch CPU spiked to 100% in the web UI and SSH sessions were slow. show mac address-table returned many duplicate MAC entries for the same physical ports. show arp on the pfSense router showed rapid ARP churn for addresses in VLAN 20. No new devices were connected besides the intended servers. STP topology appeared to converge repeatedly in switch logs timed with the spike incidents.

Already attempted

Cleared MAC table and ARP cache on the router (temporary improvement for ~5 minutes). Isolated suspect ports to a separate access VLAN (connectivity returned for some hosts). Rebooted the switch (cleared the condition until the VLAN was re-added). Verified no physical loop cables were present. Upgraded switch firmware to latest stable recommended by vendor (no change when VLAN re-added).

Question

What diagnostics should I run to determine whether this is a misconfigured trunk/native VLAN, a VLAN ID overlap with the router, an STP loop, or a switch bug? What safe, reversible configuration changes will let me bring VLAN 20 online without triggering ARP storms?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 1w ago• Trouble ID

Most likely causes

STP loop caused by an access port accidentally plugged into another switch or an unmanaged switch creating a L2 loop in VLAN 20. 90%

MAC learning corruption or memory leak in the switch firmware triggered by the VLAN ID (switch firmware bug). 80%

Trunk port misconfiguration: VLAN 20 not allowed on uplink trunk or mismatched native VLAN, causing frames to be mishandled and flooded. 40%

Summary

Symptoms point to either a VLAN leakage/loop or a switch-level bug that corrupts the MAC/ARP tables when the new VLAN is present. The repeated STP convergence in logs and duplicate MAC table entries suggest traffic is being forwarded in a loop between ports or between the switch and router, producing ARP storms. Alternatively, a firmware bug can corrupt MAC learning when certain VLANs are used, especially on older firmware. Because a reboot temporarily clears state, persistent misconfiguration (trunk/native mismatch) or a race in MAC learning under certain multicast/ARP rates are likely.

Suggested Fixes

Diagnostic step 1

Keep the new VLAN offline and reproduce in maintenance window. Capture a continuous packet trace on the router uplink (mirror trunk) while toggling VLAN 20 to see if ARP/LLDP/BC packets flood.

Diagnostic step 2

On the switch, verify trunk configuration: show interfaces trunk to confirm VLAN 20 is allowed on uplinks and that native VLAN settings match the router. Fix mismatches and re-test.

Diagnostic step 3

Enable port isolation / storm-control on affected access ports to limit broadcast/flood rate while debugging, preventing office-wide outage.