Understanding virtual port channel peer switch command

Question

1.I understand that irrespective of the STP priority, vPC primary always sends the BPDUs.The vPC secondary device will just proxy those BPDUs.

Please confirm if the above understanding is correct.

2.If vPC secondary has lower STP priority than vPC primary, who becomes the root switch? Who will forward the BPDU and who will proxy the BPDU?

3.Imagine N5k1 is vPC primary.It also has lower STP priority. Now if for some reason, N5k1 goes down, N5k2 becomes operational primary. N5k2 also becomes the STP root.

From one of the blogs, i read:

Now the Primary failed Switch N5K-1 comes online but vPC role is non-Preemptive in that case Primary N5K-1 continue to be act Operational Secondary but we have configured lower STP priority earlier on N5K-1 , now we have STP role change , Peer link will become STP root Port and that will trigger SYNC process inherit in VPC process , which blocks vPC trunk member port although time conumpation in overall process of SYNC is quite low but in production HFT envirnoment it matter alot .

So to avoid this, we use vpc peer-switch command.

Please confirm if the above behaviour is expected

Answer 1

Under normal conditions only the root ID and bridge priority of the VPC primary will be sent via VPC downstream links. Within VPC links only the operational primary transmits or processes BPDU's (nb - the secondary forwards rather than proxies). In the case of non-VPC links the actual ID's and priorities will be sent, thus allowing STP to continue to function as expected.

Best practice is that the lower (better) root priority should be on the VPC primary. If it isn't the case and the seondary has a better priority then downstream VPC connections will still receive the ID and priority of the VPC primary - even though it's the worse of the two.

If the VPC primary fails (loss of peer link + peer keepalive) then the VPC operational role shifts as the VPC secondary assumes the role of primary. In this instance you are correct that a new root bridge has appeared and STP needs to run throughout the topology - with attendant interruption of service. This is where the peer-switch feature comes in...

When enabled the peer-switch command actually causes the two VPC paired switches to create a third (common) virtual root ID that should always have the lowest priority in the topology. This means that both switches are going to send BPDU's with the virtual ID as the root of the topology and their respective physical bridge ID's as the candidate for designated forwarder.

So - Any downstream non-VPC switch will see a common root ID and two potential candidates for designated forwarder with distinct ID's but identical priorities (nb - strong suggestion that VLAN STP priorities be equal on VPC peers) and will pick accordingly (..generally choosing the lower bridge ID).

For VPC downstream switches the BPDU created by the VPC primary will just see a neighbor of the new virtual root address. In the event of a failure the secondary will maintain the identical advertisement - same ID, same priority... so zero STP convergence required.