How should (per-vlan) STP behave when interconnecting access ports from different vlans on the same switch?

Question

Half of the ports of a switch are in vlan 10, the other half in vlan 20, all untagged. In some specific situations, we need someone in the field to be able to interconnect both vlans without access to (or knowledge of) the switch config. They will plug a cable from one of the ports in vlan 10 to one of the ports in vlan 20.

On an Alcatel Omniswitch 6250, we notice the interconnection is blocked by spanning tree, both in flat and in "1x1" mode. Since 1x1 mode runs a different STP instance for every VLAN, I was expecting the ports to keep forwarding traffic between the two vlans.

The result seems to be similar on a Juniper EX. In Wireshark, we see no difference between BPDUs from different vlans. More specifically, no vlan info is found in the bridge system ID field.

The obvious but suboptimal workaround is disabling STP on these ports, but am I wrong to assume this should be possible with per-vlan STP and/or MSTP?

Because someone might ask why we are doing this, the switch is used in a mobile setup to provide two networks with different types of uplinks (satellite and LTE). As a backup plan, the operator will sometimes need to be able to (easily and quickly) join the networks so all devices can use the available uplink.

This is basically a standalone switch, but since a physical (but not logical?) loop is sometimes created on purpose, we would like STP to step in when the operator mistakenly interconnects two ports in the same vlan.

Answer 1

MSTP doesn't group VLANs automatically.

Even when you've got two switches connected through two ports assigned to different VLANs, RSTP and default MSTP block one of the ports as redundant. MSTP needs to be configured to your needs while RSTP is entirely VLAN agnostic.

You need to define MSTP instances that form independent spanning trees. Basically, you could define one instance for each VLAN (this is what RPVST+ does) but usually it's more practical to group some of them together.

Alternatively, you can run the same (all required) VLANs through the same connections and live with a single spanning tree instance. Multiple connections between two switches can also be aggregated (LAG), so they may all be used for traffic and still provide redundancy.

However, R/MSTP is only relevant when you've got redundant links between bridges/switches (or a loop on a single switch). Without blocking redundant ports, you'd get a bridge loop and the network would go down. Hosts (usually) don't transmit or listen to BPDUs, so connecting them in any way through an STP switch shouldn't block any port.

That said, you seem to be stuck in an X/Y problem. You require a redundant WAN uplink and try to work around that, colliding with STP mechanisms.

A viable approach for the intial problem is to set up a router that is connected to both VLANs 10 and 20, and to both WAN uplinks. With a proper setup, the router chooses the desired uplink and all is well.

Answer 2

I don't know about Alcatel in particular, but on a Cisco you could enable BPDU filtering on one specific port in each VLAN. Then you could bridge the two segments on those ports and achieve what you want. As others have said, this is generally a really bad idea, but it's possible, and should work fine. You'd be at risk though that if someone did use one of those special ports and bridged it to another port on the same VLAN, you'd have a loop.

On a Cisco, the config would look like this, assuming e.g. port 1 is on one VLAN and port 5 is on the other.

int G0/1
  spanning-tree bpdufilter enable
int G0/5
  spanning-tree bpdufilter enable