[c-nsp] spanning-tree problems

[Suchy Daniel]

Adam Greene wrote:
> I'd have to do some investigating to determine whether it's all Rapid PVST,
> but judging from the configs on the 3750, the switches were configured using
> generic Cisco macros, so I wouldn't be surprised if they are all the same.
> 
> I'm not too good at interpreting the debug output, but it looks to me like
> spanning-tree is not converging rapidly, which makes me wonder what the
> network topology actually is, and whether there are truly some redundant
> links and potential loops I am needing to be aware of.

Etherswitch module (in 2801) supports only 802.1D = (legacy) STP - at 
least is this reported in datasheet (I haven't real experience with this 
box). Rapid STP is 802.1w. Benefits of fast convergence in segment with 
RSTP are lost, when it interacts with device running (legacy) STP 
device. It's also question, if etherswitch module supports/runs PVST, 
standard STP is global for all VLANs, there's no per-VLAN STP instance 
separation.

 > So I think I am going to disable spanning-tree on all router vlans as
 > you suggest and increase its bridge priority, to prevent anydisruption
 > when we try plugging in again on Monday.

It's also good practice to configure bpdu-guard on ports, where have not 
arrive STP BPDUs (like ports for routers, workstations etc..) or filter 
BPDUs completely (depends on your preferences). Bpduguard shutdowns port 
when any 'unwanted' BPDU comes on access port, so it preserves 
subsequent problems like yours. Also I recomend decrease bridge priority 
on box you decide as 'best' root for your topology (and also have 
configured backup root with slightly higger value than primary root, but 
smaller value than standard).


Dan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
Url : https://puck.nether.net/pipermail/cisco-nsp/attachments/20051209/f38b920b/signature.bin