1

I have 4 offline self contained networks. They are setup as such:

  • Network 1: Windows Server 2016 As Domain Controllers And Windows 10 (1909) Clients Connected by Cisco C9300-24Ps.
  • Network 2: Windows Server 2016 As Domain Controllers And Windows 10 (1909) Clients Connected by Cisco C9300-24Ps.
  • Network 3: Windows Server 2008 R2 As Domain Controllers And Windows 7 Clients Connected by Cisco C9300-24Ps.
  • Network 4: Windows Server 2016 As Domain Controllers And Windows 10 (1909) Clients Connected by Cisco IE4000s.

Network 1 I replaced the network switches which were HP ProLiants with the Ciscos about a year and half ago and all worked well.

Network 4 I have been running for the past 3 years and they have had an issue where every single Client could not resolve the network connection as a Domain but instead saw the domain network as an "Unidentified Network."

Recently I replaced the HP Switches on Network 2 & 3 with the Ciscos and I started getting the same problem as with Network 4.

I spent the past 4 weeks going through research on some issue that could be wrong with the DNS and connection issues with Windows to no avail. Someone posted on my Microsoft thread to look into the use of PortFast with BDPUGUARD.

Today I tried to implement it and on all the Networks it fixed the issue with the client seeing the domain! 4 Weeks of work and this is what it was. It was the Cisco Switches. But this fix has led me to another question. Network setups are the same for 1, 2, 3, and 4. All with about the exact same setup of clients, and GPOs, and Network 1, 2 & 3 had the same config. So here is lies the question.

Why, to get the network to see it as a domain, do I need to enable PortFast on networks 2, 3 & 4 but I never had to do that for Network 1.

I also have a much larger network running Server 2019 with Windows 10 Clients and vastly more C9300-24Ps and devices and I didn't have to enable PortFast for that network either. The only thing I can think of that the hardware is different on the none PortFast networks than it is the PortFast networks but I have elements of some on the non PortFast networks and it works fine. So what's the catch? As far as I can tell the configs and VLANS are about the same. Why do I need to enable PortFast on some networks but not others?

Improve this question
4
  • 4
    The recommendation is that you globally enable portfast: spanning-tree portfast default and globally enable bpduguard: spanning-tree portfast bpduguard default. This will only affect the access interfaces, not the trunk interfaces (you do not want it on trunks). It is easier to globally enable it rather than on individual interfaces, and if you change an interface between access and trunk, you do not need to change it on the interface.
    – Ron Maupin ♦
    Jun 19, 2020 at 16:59
  • @RonMaupin I understand that. The question I am asking is why did I need to enable it on some networks but not others.
    – JukEboX
    Jun 19, 2020 at 17:01
  • 3
    Likely, the cause are differently defined NLA or local firewall policies - however, host configurations are off-topic here. Heed Ron's good advice and use portfast with Cisco switches (or e.g. admin-edge-port with HPE) and avoid NLA issues.
    – Zac67 ♦
    Jun 19, 2020 at 18:36
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17, 2020 at 18:42

1 Answer 1

Reset to default
6

We don't know the configuration of your servers and PCs - which is off topic here.

Portfast allows the switch ports to transition their spanning-tree mode to forwarding immediately. Without Portfast, the port must go through the spanning-tree states (down, listening, learning, forwarding). Presumably, some test that Windows does times out before the ports move to the forwarding state.

I'm guessing that you didn't see this problem on HP switches because unlike Cisco, spanning-tree is disabled by default.

Improve this answer
3
  • Spanning tree was disabled by default on the Cisco switches as well as Port Fast. And there is no configuration on the servers or PCs. They are fresh installations right out of the box.
    – JukEboX
    Jun 19, 2020 at 19:14
  • 1
    @JukEboX, you do not disable the switch STP, you disable it per VLAN, and right out of the box, it is enabled as PVST+, but you should change that to Rapid-PVST+. It is an extremely bad idea to disable it on a VLAN because someone plugging in a cable that connects two of the switch interfaces in the same VLAN will kill the VLAN. I have seem idiots do that on the wall plates just to see what happens.
    – Ron Maupin ♦
    Jun 19, 2020 at 19:52
  • @RonMaupin Sorry I meant PortFast was disabled by default. Weird.
    – JukEboX
    Jun 22, 2020 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.