Hi and thanks for taking the time to read this. I have some understanding of networking but am looking for help designing the best solution for an environment.

It consists of approx ~30 users with computers and IP phones. We have a Cisco ASA5505 for firewall, VPN and internet gateway, two HP V1910 24-port PoE switches for the LAN (and powering the phones) and two more regular HP V1910 24-port switches where hosts and storage reside for virtual infrastructure (ESX) and other network appliances.

What is the best practices for linking these all together? I've sketched a rough diagram below on how it looks currently. Currently, links between switches are untagged on the data VLAN and tagged on other VLANs to allow traffic on those to pass between switches. Could this be improved in any way? Please ask anything if needed to clarify. Thank you.

PoE SW 1------PoE SW 2------ASA5505
   |              |
   |              |
  SW 1----------SW 2
  • Are you running spanning tree & which version as looks like these switches support 802.1d, rapid and MSTP? Where is your root bridge placement and where is the ingress for the bulk of your traffic?
    – MattE
    Jan 22, 2014 at 5:30
  • When you say linking these all together, are you talking about refining your VLAN setup or the overall topology (including the VLAN setup)?
    – Ryan Foley
    Jan 22, 2014 at 8:07
  • Just curious, why is everyone so afraid of spanning tree?
    – Ron Trunk
    Jan 22, 2014 at 22:57
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10, 2017 at 2:49

2 Answers 2


In my opinion, pyatka's solution looks like overkill. I like the hub-and-spoke topology though. Your initial topology is redundant, but leaves you highly dependent on Spanning Tree being configured and working properly in order to prevent network loops.

I don't think you need IP's on the inter-switch links. Simply uplink each access switch (PoE SW1, PoE SW2, and SW3 in the graphic) with your new "core," SW 4, with trunk ports with the default VLAN allow settings which allow all VLAN traffic.

Each of the switches can have a port-by-port vlan assignment based on need. All the vlan routing is done on SW4. This means that SW4 will be the default gateway for each VLAN. For example on the user VLAN 20, your hosts will be configured with default gateway of and then on SW2: (this is how on a Cisco IOS switch, check you HP documentation for exact syntax):

SW4# vlan 20
description users
ip address
ip helper-address X.X.X.X <- DHCP server, if present

SW4 will also then have a default route for that sends outbound traffic out G1/1/4 to the ASA.

Use copper (or fiber if >100M) GBICs for your trunk ports from the access switches to SW4. Then you can still have 24 Ethernet ports on SW4 for end devices.

Obviously, you manage the switches on a dedicated management VLAN.

I think this is a setup that gives you the most flexibility and ease of management.

Chime in if you need more details on switch configuration options.

enter image description here

  • Your right, pyatka's solution is overkill. You will get no discernible benefit from using layer 3 protocols since a dead link is a dead link. A Dedicated Management VLAN is the way to go with a network this small.
    – Ryan Foley
    Jan 22, 2014 at 20:48

With your switches(http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c03941555-2.pdf), you can terminate access vlans on them (local vlan topology), a-la:

local vlan topology local vlan topology, imho the best way: no loops (you dont need stp) no vtp simple debugging

this topology, has one significant minus - expensive(in comparsion with l2) Layer 3 switches(you have them)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.