Manager states we cannot put retail switches on network due to fear of non-STP config and network storm problems. Is this true?

Question

I'm a desktop support engineer working with a Cisco certified manager. I value her opinion greatly when it comes to networking issues. However, I'm split on this because with my knowledge of networking (granted not as much as hers) I don't see how this particular setup would be a problem. But here goes:

Our boss asked us for a fairly cheap solution which places 6-7 client machines, 2 printers in a trailer outside of our building. The network inside the building consists of several Cisco devices such as ASA, 3750 switches, routers, etc. She asked me what my solution would be.

My solution: Run a Cat6 cable from one of the 3750 switches to the trailer and add two 8 port retail switches. The client machines and printers would connect to the switch and from there to the 3750's and our network.

She said this wouldn't work because there is no STP on the switches and if anyone were to plug in a cable both ends into the retail switch it would cause a network storm on our entire network.

My problem with this is that wouldn't the 3750's STP prevent that from happening?

Answer 1

Great question!

This is because a layer-2 switching loop can form on the Consumer-grade switching equipment which could produce Broadcast Radiation and impact devices connected to the broadcast domain.

---

STP was originally standardized as IEEE 802.1D. Its purpose is to build loop-free, layer 2 typologies. STP does not detect and then mitigate Broadcast Radiation. STP builds loop-free topologies by sending special frames called Bridge Protocol Data Units.

BPDUs are sent out as multicast frames to which only other layer 2 switches or bridges are listening. If any loops (multiple possible paths between switches) are found in the network topology, the switches will co-operate to disable a port or ports to ensure that there are no loops; that is, from one device to any other device in the layer 2 network, only one path can be taken. - Configuring Spanning Tree Protocol

To oversimplify, devices running STP will broadcast BPDUs and listen for duplicate messages. If duplicate messages are heard, a loop will be detected and the STP domain will converge by blocking the appropriate ports.

Many consumer-grade devices such as this common D-Link switch, do not call out support for IEEE 802.1D or newer flavors of STP.

Consumer-grade devices, without this mechanism, can form a loop between itself, or with another consumer-grade layer-2 device. The rest of the broadcast domain could be then subjected to the resulting crippling broadcast traffic even though it is not a part of the actual layer-2 switching loop.

There are some mechanisms (such as Storm Control) and strategies to reduce the risk and the effects of the negative traffic but they are outside the scope of this post.

Answer 2

STP will hopefully prevent a loop involving the STP capable switches (unless the non-stp switches filter out the STP packets), but it won't prevent a loop involving only the non-stp switches.

Possible solutions include.

1. Look into the port protection features on your cisco switch. There are "storm control" options that can block a port if it sources too much broadcast traffic. There are mac address limiting functions that can block a port if it shows two many source MAC addresses.
2. Try and find a middle ground switch that is cheaper than the ciscos but still high enough up the market to support the spanning tree variant you use.
3. If you have a spare router/firewall port put the trailer on that with it's own subnet. Ethernet storms won't cross a router.