Block L2 Loops without STP?

Question

I have a weird problem: I have a layer 2 network that does not pass STP BPDUs and cannot be configured to do so. I would like to establish multiple redundant connections to this network from my all-Cisco network, but if I do, I create a network loop. What would you recommend as an alternative to RSTP for Cisco switches that can shut down ports to block loops, but bring those ports up automatically if the primary goes down? Thanks!

Answer 1

If you're unable to use Spanning Tree Protocol (STP), I would recommend looking into Dynamic ARP Inspection (DAI).

If you set the DAI rate limit of ARP packets to the absolute lowest your network environment will support, it should cause a port with a layer 2 loop to go into an err-disable state.

Understanding and Configuring Dynamic ARP Inspection

Answer 2

These boxes are obviously bad news. So what you want to do is to place a private link-layer around those boxes. Cisco gives you two tunnelling options on their switching devices: Q-in-Q or TRILL (there's even more possibilities on their IP/MPLS devices). Q-in-Q is probably easier for you to get your head around. Configure Q-in-Q to transport all the client-port BPDUs transparently. Then it looks to your A/V gear like they are neighbours on the same hub. They can happily chat their bastardised protocols between the two of them.

Once you get that working, simply implement a protected service for the network-side VLAN (aka "s-tag"), in your usual fashion (which I think was STP and interface costs, but you could also use LAGs or whatever).

You can grow Q-in-Q into a proper multi-client subnet, should you have more than two of these nightmare boxes. You might also need to do that to get an Internet service into the client-side VLAN.

Answer 3

That is what spanning tree does. There are various flavors of STP, and there are some alternatives, e.g. TRILL, but most are proprietary. It is probable that your layer-2 network that does not support spanning tree will not support one of the alternatives, either.

Answer 4

If it supports LAG you can combine the redundant links into port-channels that are viewed as a single link. However, both of those links would have to connect to the same Cisco switch unless you are running VSS or Nexus vPC.