Suppose there is a ring with two routers (L3 switch) and 3 switches. All devices are configured properly.VRRP is configured on both routers and one virtual gateway is introduced to switches and their clients.

enter image description here

Can I disable spanning tree protocol on all switches? Does the VRRP function as protection? To clarify my question: Suppose the link between switch 1 and switch 2 gets down. Is gateway accessible for all switches and their clients by VRRP?

enter image description here

  • We cannot answer your question without more detail. You'll need to add the (sanitized) configurations of all devices and their make/models to your question.
    – Zac67
    Mar 9, 2019 at 12:41
  • Is the link between the routers part of the L2 ring?
    – Ron Trunk
    Mar 9, 2019 at 12:50
  • No, as I updated the figures, the link between the routers is configured as an L3 link. You can suppose OSPF is running on routers
    – A.A
    Mar 9, 2019 at 13:06
  • The details you provide are not remotely enough. VRRP and STP are not alternatives. They may be used in combination but all depends on the specific device configurations.
    – Zac67
    Mar 9, 2019 at 13:11
  • And in response to @Zac67: I want to know the standard VRRP ability itself, regardless of vendors or devices, whether it is capable of handling protection without xSTP or not.
    – A.A
    Mar 9, 2019 at 13:15

3 Answers 3


As explained in the question comments, no it is not VRRP or STP, as those features address different needs.

STP is about links, i.e. layer 2, while VRRP is about IP gateways, i.e. layer 3.

In the case you get your layer 2 network split in half, like in your second diagram, yes all clients have a gateway to speak to, and so they can send data.

But how will they receive the responses?

If those responses arrive on router 1, it will look in its routing table and find it has a directly connected interface and will send it through this interface. Clients connected behind router 2 will not receive any response.

So, no, your proposal will not work, except for one-way communication, which is pretty rare.


As @JFL has already pointed out, your failover concept has a problem when one of the switches or one of their interconnects fails - currently there's no L2 redundancy. This is because VRRP makes the L3 gateways redundant, not the L2 switches/links.


The best-practice approach would be to remove the chain of switches and connect each of them to both L3 switches. Depending on the size of the network you could either use a separate L3 link and IP subnet for each L2 switch or use one or more VLANs that are spanning all switches. Of course, this creates multiple potential bridge loops, so RSTP/MSTP is required.

STP in tree

With the tree, the L2 switches communicate through the root switch in normal operation and when the root fails the L2 connects will failover to the designated L3 switch. VRRP takes care of L3 connectivity at the same time.


If you can't get rid of the chain (due geographical restrictions or similar) you need to connect the access VLAN across the L3 switches as well (VLAN trunk). As that would create a bridge loop across the L2 switches, RSTP/MSTP is required to break that loop.

STP in chain

Use the main L3 switch as root bridge (lowest priority value) and the backup as designated (second lowest priority value). One of Switch2's uplinks will block in normal operation. It will reactivate if any link fails, restoring L2 connectivity. Even when an L2 switch fails the other will keep their uplinks.


No, you can't disable STP in this case. VRRP is on L3, STP is on L2. Your router is a L3 switch, so the switches are connected by bridge ports. Some switches might change the port type (e.g. Comware or Cisco) from bridge to a route port. A route port is still an ethernet interface, but it does not take part of STP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.