Having difficulty grasping STP and if we would need it with the topology we have. The diagram is a top down view of our layout, and each "layer" is a different building connected by fiber, orange links are fiber, blue are Cat5e. In my rookie opinion, it doesn't look like we have anywhere that would cause a broadcast storm, am I wrong?

enter image description here

  • 2
    The question is, why wouldn't you use STP? If you don't have a compelling reason to not use it, you should be using it. No, you don't need it based on this diagram, but what happens when something changes or some user does something they shouldn't? Are you not ever planning to provide alternate redundant paths to the network? – YLearn Apr 9 '15 at 15:01
  • Just not familiar with configuring it, and figured I could do more harm than good if I configured it wrong. – Matt Fogleman Apr 9 '15 at 15:34
  • 2
    In general, STP just works (even if not ideally). The standard has been around a long time and is pretty well supported across the industry. It is usually when people start trying to change the default behaviors of STP (without understanding STP) that they run into trouble. – YLearn Apr 9 '15 at 17:01
  • 2
    The latest philosophy that I keep hearing about is to design so that STP isn't necessary, but leave it enabled as a failsafe in case someone misconfigures or plugs in something incorrectly. Cisco has pushed the concept, "single-switch per VLAN," for a few years. Many people misunderstand it to mean, "single-VLAN per switch," but that is completely incorrect. – Ron Maupin Apr 9 '15 at 18:42
  • To expand Ron's comment, I've been told by a Cisco employee that they really prefer using routing protocols (i.e., EIGRP) for core and distribution layer failover as opposed to STP because the convergence time on EIGRP is so much shorter - hence routing between switches. Also I want to put a thought in for RPVST+ on Cisco switches. – Todd Wilcox Apr 9 '15 at 18:59

You are correct that STP is not needed in this setup, as you have no physical (or logical) loops. However, run it anyway to protect yourself from yourself and others. If a user were to accidentally connect two wall jacks together, you'd introduce a storm without STP.

  • Users are, generally, morons.. Always have STP enabled.. It's so easy for a user created loop to appear . – Tom O'Connor Apr 10 '15 at 22:58

Your setup should not need STP but it is there and as the administrator, you must protect your network from the "morons" as Tom mentioned above.

There are also some network attacks that will bring down your network... http://www.techrepublic.com/blog/it-security/myth-or-not-most-security-breaches-originate-internally/

Usually you would want to keep STP and it's modern variants (RSTP, MSTP) away from the core(s) and configure your distribution switches as your designated spanning-tree primary and secondary roots. Note:- Your distribution switches appear to be access switches and I don't think they would support an IGP routing protocol such as OSPF to connect to your core switch.

This leaves your only core switch (spanning-tree root) subject to whatever nightmares your clients will bring to the network... and you don't want that phone call on a Friday afternoon telling you the network is down while you should be going fishing for the weekend!!

There is a bit of work to do to protect your clients from themselves and you may have to do it in approved Change Management windows (ITSM)

At the root trunks investigate "spanning-tree guard root" and other features such as UDLD. https://supportforums.cisco.com/discussion/10707896/spanning-tree-guard-root-command

On the access switches at the switchports, possibly plan to roll out port security and if required "IP DHCP Snooping" and possibly DAI http://packetpushers.net/yes-we-really-need-dynamic-arp-inspection/

If not already, use a syslog server (some Linux virtual machine) to log what happens on your network for if you have to investigate/fix what caused a network outage, it will help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.