1

A Cisco switch (IOS) on our network configured with VLAN 7 and VLAN 8 as access VLANs (7 being the native for the trunk on the switch) had the VLANs bridged by someone who connected a patch cable from one network jack to another network jack (essentially connecting two ports together one with access VLAN 7, the other with access VLAN 8).

This created a bridge that caused all static IP devices from VLAN 8 to stop working, and any DHCP requests that came from a port that was configured to VLAN 8 was answered by the subnet on VLAN 7.

I've found a great deal of documentation on how and why people would want this enabled, however, I want this type of behavior to be errdisabled, and I'm not sure which spanning tree configuration (if any) would allow me to block this behavior.

The two ports just had a 3 basic configurations:

 switchport access vlan 8
 switchport mode access
 spanning-tree portfast

 switchport access vlan 7
 switchport mode access
 spanning-tree portfast

From my understanding, spanning-tree guard root would only errdisable a port if it detects a potential switching loop, however this wasn't a loop, but a bridge. What would be the best practice here?

Improve this question
2
  • As an additional note, this bridging was generating error "CDP-4-NATIVE_VLAN_MISMATCH:", which was going largely ignored at first because it didn't appear to be of a high enough severity to cause a subnet to stop working (we started looking at the DHCP scope first).
    – Gabriel
    Apr 11 '17 at 1:07
  • By the way, always start troubleshooting at layer-1, then move to layer-2, etc.
    – Ron Maupin ♦
    Apr 11 '17 at 1:59
0

You can, and really should, globally enable portfast and bpduguard:

spanning-tree portfast default
spanning-tree portfast bpduguard default

This will errdisable access interfaces receiving BPDUs. It does not affect trunk interfaces unless you use the trunk keyword.

When you do this globally, you don't need to worry about configuring and changing individual interfaces as their roles may change.

Improve this answer
3
  • Thanks, I didn't know global portfast was an option. Will bpdu guard have errdisabled the ports in the scenario above?
    – Gabriel
    Apr 11 '17 at 1:37
  • Yes. Switches send out BPDUs, and any interface with both enabled will errdisable.
    – Ron Maupin ♦
    Apr 11 '17 at 1:53
  • @Gabriel, I would also add that it is a best practice to shut down any unused interfaces until they are going to be used. That prevents such accidents, some intrusions, and anyone enabling will be able to see which VLANs are being enabled.
    – Ron Maupin ♦
    Apr 11 '17 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.