2

Half of the ports of a switch are in vlan 10, the other half in vlan 20, all untagged. In some specific situations, we need someone in the field to be able to interconnect both vlans without access to (or knowledge of) the switch config. They will plug a cable from one of the ports in vlan 10 to one of the ports in vlan 20.

On an Alcatel Omniswitch 6250, we notice the interconnection is blocked by spanning tree, both in flat and in "1x1" mode. Since 1x1 mode runs a different STP instance for every VLAN, I was expecting the ports to keep forwarding traffic between the two vlans.

The result seems to be similar on a Juniper EX. In Wireshark, we see no difference between BPDUs from different vlans. More specifically, no vlan info is found in the bridge system ID field.

The obvious but suboptimal workaround is disabling STP on these ports, but am I wrong to assume this should be possible with per-vlan STP and/or MSTP?

Because someone might ask why we are doing this, the switch is used in a mobile setup to provide two networks with different types of uplinks (satellite and LTE). As a backup plan, the operator will sometimes need to be able to (easily and quickly) join the networks so all devices can use the available uplink.

This is basically a standalone switch, but since a physical (but not logical?) loop is sometimes created on purpose, we would like STP to step in when the operator mistakenly interconnects two ports in the same vlan.

  • "They will plug a cable from one of the ports in vlan 10 to one of the ports in vlan 20." That is a really bad idea that will not accomplish what you think it does, and may cause you no end of trouble. Communication between VLANs (layer-2) needs to happen through a router (layer-3). Sharing a gateway will not work because a gateway needs to be addressed in a network for which it is the gateway, otherwise a host would need a gateway to reach the gateway. – Ron Maupin Jun 9 '18 at 20:01
  • @RonMaupin The gateway, which is also the DHCP-server, will be removed from one of the VLANs and all devices will be rebooted. I know this is not a normal situation, but we don't have the luxury of some extra space in a 19" rack. All equipment is built into the trunk of a car. – Gerben Jun 10 '18 at 17:14
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:40
1

MSTP doesn't group VLANs automatically.

Even when you've got two switches connected through two ports assigned to different VLANs, RSTP and default MSTP block one of the ports as redundant. MSTP needs to be configured to your needs while RSTP is entirely VLAN agnostic.

You need to define MSTP instances that form independent spanning trees. Basically, you could define one instance for each VLAN (this is what RPVST+ does) but usually it's more practical to group some of them together.

Alternatively, you can run the same (all required) VLANs through the same connections and live with a single spanning tree instance. Multiple connections between two switches can also be aggregated (LAG), so they may all be used for traffic and still provide redundancy.

However, R/MSTP is only relevant when you've got redundant links between bridges/switches (or a loop on a single switch). Without blocking redundant ports, you'd get a bridge loop and the network would go down. Hosts (usually) don't transmit or listen to BPDUs, so connecting them in any way through an STP switch shouldn't block any port.

That said, you seem to be stuck in an X/Y problem. You require a redundant WAN uplink and try to work around that, colliding with STP mechanisms.

A viable approach for the intial problem is to set up a router that is connected to both VLANs 10 and 20, and to both WAN uplinks. With a proper setup, the router chooses the desired uplink and all is well.

| improve this answer | |
  • I was hoping for a specific answer about Alcatels "flat" and "1x1" mode, or a generic answer about interconnecting two vlans on one switch. I agree with the content of your answer, but I feel it is not really an answer to my question. – Gerben Jun 20 '18 at 14:53
  • No, it doesn't directly answer your question. I was trying to convey some basic understanding of where these effects come from. What you're doing simply doesn't work in a serious setup, ie. with STP activated. – Zac67 Jun 20 '18 at 17:28
0

I don't know about Alcatel in particular, but on a Cisco you could enable BPDU filtering on one specific port in each VLAN. Then you could bridge the two segments on those ports and achieve what you want. As others have said, this is generally a really bad idea, but it's possible, and should work fine. You'd be at risk though that if someone did use one of those special ports and bridged it to another port on the same VLAN, you'd have a loop.

On a Cisco, the config would look like this, assuming e.g. port 1 is on one VLAN and port 5 is on the other.

int G0/1
  spanning-tree bpdufilter enable
int G0/5
  spanning-tree bpdufilter enable
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.