7

I'm a desktop support engineer working with a Cisco certified manager. I value her opinion greatly when it comes to networking issues. However, I'm split on this because with my knowledge of networking (granted not as much as hers) I don't see how this particular setup would be a problem. But here goes:

Our boss asked us for a fairly cheap solution which places 6-7 client machines, 2 printers in a trailer outside of our building. The network inside the building consists of several Cisco devices such as ASA, 3750 switches, routers, etc. She asked me what my solution would be.

My solution: Run a Cat6 cable from one of the 3750 switches to the trailer and add two 8 port retail switches. The client machines and printers would connect to the switch and from there to the 3750's and our network.

She said this wouldn't work because there is no STP on the switches and if anyone were to plug in a cable both ends into the retail switch it would cause a network storm on our entire network.

My problem with this is that wouldn't the 3750's STP prevent that from happening?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 7 '17 at 21:47
9

Great question!

This is because a layer-2 switching loop can form on the Consumer-grade switching equipment which could produce Broadcast Radiation and impact devices connected to the broadcast domain.


STP was originally standardized as IEEE 802.1D. Its purpose is to build loop-free, layer 2 typologies. STP does not detect and then mitigate Broadcast Radiation. STP builds loop-free topologies by sending special frames called Bridge Protocol Data Units.

BPDUs are sent out as multicast frames to which only other layer 2 switches or bridges are listening. If any loops (multiple possible paths between switches) are found in the network topology, the switches will co-operate to disable a port or ports to ensure that there are no loops; that is, from one device to any other device in the layer 2 network, only one path can be taken. - Configuring Spanning Tree Protocol

To oversimplify, devices running STP will broadcast BPDUs and listen for duplicate messages. If duplicate messages are heard, a loop will be detected and the STP domain will converge by blocking the appropriate ports.

Many consumer-grade devices such as this common D-Link switch, do not call out support for IEEE 802.1D or newer flavors of STP.

Consumer-grade devices, without this mechanism, can form a loop between itself, or with another consumer-grade layer-2 device. The rest of the broadcast domain could be then subjected to the resulting crippling broadcast traffic even though it is not a part of the actual layer-2 switching loop.

There are some mechanisms (such as Storm Control) and strategies to reduce the risk and the effects of the negative traffic but they are outside the scope of this post.

| improve this answer | |
  • The obvious solution is to put a switch that is STP capable. You need to check which version of STP is used on the 3750 switch and choose the new switch accordingly. – JFL Jun 14 '17 at 6:13
  • @TDurden: A loop can also be created with a single non-STP switch connecting two STP ports. All STP ports need to be attached to each other to reliably detect loops. – Zac67 Jun 14 '17 at 18:03
  • @Zac67 - I completely agree. – TDurden Jun 14 '17 at 18:11
2

STP will hopefully prevent a loop involving the STP capable switches (unless the non-stp switches filter out the STP packets), but it won't prevent a loop involving only the non-stp switches.

Possible solutions include.

  1. Look into the port protection features on your cisco switch. There are "storm control" options that can block a port if it sources too much broadcast traffic. There are mac address limiting functions that can block a port if it shows two many source MAC addresses.
  2. Try and find a middle ground switch that is cheaper than the ciscos but still high enough up the market to support the spanning tree variant you use.
  3. If you have a spare router/firewall port put the trailer on that with it's own subnet. Ethernet storms won't cross a router.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.