In the network below, I have a simple setup of two hosts (R1 and R2). They both are connected to a L2 access switch. Both the L2 access switches are connected on two interfaces to the L3 distribution switches. Key task is to make the communication between R1 and R2 redundant, meaning that if one of the L2 access switches would die, communication may not be interrupted.

I know already that there is a chance that network packets "loop" in the "upper square", and that you have to use Spanning Tree Protocol (STP) to prevent loops.

Unfortunately, I don't understand how to configure this properly with VLAN ID's. I do not use VLAN's in my setup. Do you need to use them to make STP work?

R1 and R2 are both Cisco Catalyst 7200 routers. SW1 and SW2 are both generic L2 switches. ESW1 and ESW2 are L3 switches, which are running a Cisco 3725 IOS. In GNS they are called EtherSwitch.

The whole setup is made in GNS 1.1.

Basic setup of my network

  • 2
    Without a second link to another access switch, if an access switch dies, everything exclusively connected to it goes out as well. Oct 27, 2014 at 16:17
  • Yosef is correct. But also, just to clarify - you don't use any VLANs (with the exception of the mandatory default) at all? Oct 27, 2014 at 18:38
  • Using VLANs would be beneficial as you could direct some VLANs to one distribution switch and some to another
    – eric
    Oct 27, 2014 at 20:39
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10, 2017 at 22:58

2 Answers 2

  1. user4565 brings up a very important point, you need the redundant connections. You could have all of the redundancy in the world upstream of R1/R2, if a link between R1/R2 and SW1/SW2 goes down, that corresponding R is still going to be offline.

Add the following connections for the best possible redundancy:

  • R1 <=> SW2
  • R2 <=> SW1

Now you can lose either SW1 or SW2, and still have connection to your R's.

  1. As user4565 said, add another trunk between ESW1 and ESW2 - more redundancy isn't a bad thing.

  2. Make sure all of your trunk links carry both VLANs if you decide to use more than the default VLAN.

Just to clarify a couple of extra things, if you're interested:

You will always a native VLAN, one will always exist (VLAN 1 by default).

Unless you're running some seriously ancient gear, Cisco typically runs STP in the default mode of PVST+ or RPVST+. This means that each VLAN you configured, will have it's own instance of STP running (PVST = Per Vlan Spanning Tree). This is helpful because let's say you have 2 VLANs, VLAN 1 and VLAN 10. If something breaks in VLAN10, it will adjust the paths accordingly, and leave VLAN1 completely unaffected, this means zero service disruption for VLAN1.

Just a little bit more older STP context, it used be that only a single instance of STP ran, no matter how many VLANs you had. That means, if you had a link in VLAN1 go down, all other VLANs would have disruptions because STP had to recalculate the loop free paths. This is why PVST is so important.

Along with each VLAN having its own instance of spanning tree, PVST+ adds some other capabilities. The important one being, alternate ports. Let's look at the difference of how an older version of STP would run vs. PVST+ when an outage event happens, if you had two interfaces, connecting the same two devices (in EACH VLAN, so lets just say you have VLAN1 only).


  • R1 Eth1/1 <=> SW1 Eth2/1
  • R1 Eth1/2 <=> SW1 Eth2/2

Older STP:

  1. IMPORANT: When STP calculates, there can only be one path, all others are automatically blocking, this is how STP prevents loops.

    • R1 Eth1/1 <=> SW1 Eth2/1 - FORWARDING
    • R1 Eth1/2 <=> SW1 Eth2/2 - BLOCKING

That blocking port doesn't know anything, if its up, it is only used if STP needs to recalculate.

  1. Link 1 of 2 breaks in some way (shutting a link, cable being cut, cable failing, etc.)
  2. STP will tell the entire STP domain to flush its entire topology and recalculate all paths. Resulting in service disruption.
  3. After STP recalculates, the port that was originally BLOCKING will move through the LISTENING, and LEARNING states before entering FORWARDING. This can take some time, thus causing downtime.

    • R1 Eth1/2 <=> SW1 Eth2/2 - FORWARDING


  1. IMPORANT: When PVST+ calculates, something different happens with those extra interfaces you have connected. If R1 has two ports connected to R2

    • R1 Eth1/1 <=> SW1 Eth2/1 - FORWARDING
    • R1 Eth1/2 <=> SW1 Eth2/2 - ALTERNATE

The difference with PVST+ is in the initial calculation, when the loop free topology is built, redundant ports facing upstream to the root bridge will be an alternate port. This means that it KNOWS that the alternate port is a way to the root bridge, so should the primary link fail, it doesn't need to recalculate - it can immediately jump to the FORWARDING state and push traffic as normal, instead of being forced to run through all of the phases again.

  1. Link 1 of 2 breaks in some way.
  2. R1 Eth1/2 immediately switches to forwarding.

    • R1 Eth1/2 <=> SW1 Eth2/2 - FORWARDING
  3. No service interruption.

Hope this helps, I apologize if it's a bit long winded - but it helps to know your options. If you need any clarification, feel free to ask.


Yes spannning tree is for preventing loops at layer2.

In this simple setup you may want to add a few of things:

  1. Add another trunk link connecting ESW1 to ESW2.
  2. Make ESW1 stp root primary and ESW2 stp root secondary.

You can then check your spanning tree root paths for vlan1 (default) on both sw1 and sw2. And add many other test vlans for your studies.

Note that should you shutdown sw1, your client R1 will still be cut off as it only has one link (path).

You could also consider researching/adding vtp version 2 to your scenario to propagate the vlans you create on ESW1 or ESW2 to the access switches.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.