Overview

Storm control (broadcast, multicast, unicast) is a critical traffic policing feature on enterprise switches that prevents uncontrolled packet floods from overwhelming your network backbone. Misconfiguration can lead to silent packet drops, stacking failures, or optical link flaps. This FAQ delivers engineer-level answers to the most common pre-sales and post-sales questions about storm control implementation on modern datacenter and campus switches.

Frequently Asked Questions

Q1: What is the maximum throughput (Gbps) of storm control broadcast multicast unicast policing on a typical 48-port 10G switch?

Storm control can police traffic at the full line rate of each interface, typically 10 Gbps per port on SFP+ ports and up to 40 Gbps on QSFP+ uplinks. However, the effective limiting granularity is hardware-dependent: most Broadcom Trident 3-based switches enforce storm thresholds in 1% or 10 Kbps increments from 0.01% to 100% of the interface bandwidth. For a 48x10G switch with 4x40G uplinks, total policed throughput equals switching capacity (e.g., 1.28 Tbps) when storm control is applied per-port; there is no aggregate storm policing bottleneck across the backplane.

Q2: What is the backplane capacity and switching fabric bandwidth available when storm control multicast is enabled?

The backplane capacity remains unchanged when storm control is active — typically 1.28 Tbps for a 48-port 10G switch with 4x40G uplinks. Storm control filtering occurs at ingress line cards before packets reach the fabric; hence enabling broadcast, multicast, or unicast storm protection does not reduce fabric bandwidth. For example, a switch with 2.56 Tbps non-blocking fabric will still forward 2.56 Tbps even with per-VLAN storm control thresholds set to 5%.

Q3: What are the exact CLI commands to configure storm control broadcast multicast unicast on a Cisco Catalyst or Juniper EX series switch?

For Cisco IOS: interface GigabitEthernet1/0/1 → storm-control broadcast level 10.5 → storm-control multicast level 5 → storm-control unicast level 2 (values in percentage of bandwidth). For Juniper EX: set interfaces ge-0/0/1 ether-options storm-control broadcast bandwidth 10m → set interfaces ge-0/0/1 ether-options storm-control multicast bandwidth 5m. Commit changes. To verify: Cisco uses show storm-control; Juniper uses show ethernet-switching storm-control. All commands are applied immediately without reboot.

Q4: Does enabling unicast storm control affect SFP+ optical module compatibility or link negotiation?

No, unicast storm control operates at Layer 2 forwarding logic and does not alter optical module electrical signaling or SFP+ DOM (Digital Optical Monitoring) parameters. Compatible SFP+ modules (SR, LR, ER, ZR) will continue to negotiate link at 10G regardless of storm control thresholds. However, if storm control drops excessive unknown-unicast frames due to MAC table flooding, an optical link may appear to ‘flap’ logically (high error counters) even though physical light levels remain normal. Always use show interface transceiver to verify optical health before blaming storm control.

Q5: How does storm control broadcast differ between stacking interfaces (virtual chassis) vs. standard access ports?

On stacking interfaces (e.g., StackWise Virtual on Catalyst 9500, VCP on Juniper Virtual Chassis), broadcast storm control is typically disabled by default because stacking links carry proprietary control plane traffic. Enabling broadcast storm control on a stacking port can inadvertently drop essential stack heartbeats, causing a split-brain scenario. Best practice: apply storm control only on access or uplink ports; leave stacking interfaces with default no storm-control. For multicast traffic across stack members, use per-VLAN storm control at the stack master level: storm-control broadcast level 5 vlan 10 (Cisco) — this applies to all member ports in that VLAN irrespective of stacking.

Q6: What is the recommended troubleshooting sequence when redundant power supply failover occurs and storm control metrics spike?

After a PSU failover (e.g., AC to DC module), follow this 3-step sequence: 1) Check system logs: show logging | include storm — PSU switch events may reset ASIC buffers, temporarily increasing broadcast rates. 2) Verify storm control counters: show storm-control unicast interface Gi1/0/1 — compare to baseline PPS thresholds. 3) If drops persist, manually clear counters (clear storm-control counters) and reapply thresholds after a 10-second cool-down. Do not simply disable storm control — a spike often indicates a failed NIC on the same PSU circuit. Replace the failing endpoint NIC before re-enabling thresholds at 50% of original value.

Q7: Can storm control multicast interfere with IGMP snooping or PIM sparse-mode routing?

Yes, if multicast storm control is set below the forwarding rate of legitimate IGMP control plane traffic (e.g., below 1 Mbps). IGMP queries (125 bytes every 125 seconds) require extremely low bandwidth, but dense multicast streams (e.g., IPTV at 20 Mbps per channel) may be suppressed. Always configure multicast storm control at ≥2% of interface bandwidth or ≥10 Mbps for 1G ports. For PIM sparse-mode, ensure storm control thresholds account for Register-Stop and Join/Prune messages — set a separate higher threshold (5%) on the rendezvous point (RP) facing interfaces. Use show ip igmp snooping mrouter to verify multicast router ports are not being rate-limited.

Q8: What is the difference between storm control broadcast multicast unicast on a current-generation Arista 7050X3 versus legacy Catalyst 2960?

The Arista 7050X3 (Broadcom Jericho2) supports hardware-accelerated per-queue storm control with 1 Kbps granularity and separate thresholds for known-unicast vs. unknown-unicast, plus flow-aware storm control that automatically raises thresholds during bursts. Legacy Catalyst 2960 (10+ years old) uses software-based policing with 1% granularity and only unknown-unicast control. Key upgrade benefits: 40x higher storm control state capacity (16k vs 400 entries), sub-millisecond reaction time vs 200ms, and support for multicast storm control on L3 interfaces (VLAN interfaces). Migrating configurations: convert legacy storm-control broadcast level 10 to storm-control broadcast level 10 Kbps 1000 Kbps on Arista for equivalent behavior.