0

Topology:

(Ring Network A)----[Router A]-------(Possibly Ring Network C)-------[Router B]----(Ring Network B)

Goals

  • I need Router A to always be the RSTP root bridge for Network A.
  • I need Router B to always be the RSTP root bridge for Network B.
  • Without getting into details, Network C doesn't always exist; or at least the link to A and B doesn't always exist.
  • I don't care what role Router A and B take within Network C.

I currently have this configured for RSTP. But what happens is that when Network C connects Router A to Router B, TCNs happen and devices in Network A, and Router A, will declare Router B as the root bridge (it has lowest MAC). Since Network C comes and goes, it causes interruptions during reconfiguration/convergence.

So what is the proper solution here? Some ideas:

  • Turning off Spanning Tree on Network C facing ports on Routers A and B
  • MST... I have never used it, as it seems to be a way to combine various VLANs into a single spanning tree instance.. and that's not really what I'm trying to do here. It does seem to support the concept of "regions" or "boundaries" though, and that may be what I need.

Some additional notes that may add clarity.. or may muddy the waters:

  • I stated that network C is "possibly" ring. It is not a ring right now, but may be in the future.
  • I hadn't realized I would need to do something like this because I (incorrectly) assumed that a routable interface would not forward BPDUs from a routable interface in another network. I essentially thought the RSTP domain would stay within the layer 2 network. i.e. Router A would be the root bridge on the interfaces facing Network A, and perhaps non-root (designated bridge?) on the interface(s) for Network C.

Edit #1:

  • Several questions were asked for if it's actually a router, and what device is it. It's a layer 3 switch/router. RuggedCom RX1512
  • Based on some of the comments and answers, it sounds like the RSTP BPDUs from one network should not be getting through the router and influencing the other networks. Comment from Ricky states: "Routers don't participate in STP. (switch modules in a router may)". This may be my situation.

Edit #2:

Quick side note: as mentioned, it's a L3 switch, and I'll keep using the word 'router' to be consistent.

I am using SVIs. There's a VLAN and IP applied to interfaces in Network A, and similarly to the Network C facing interfaces. Different subnets. No tagging or anything going on. Only using VLAN and SVIs to define the network separation.

This seems to say that STP would not propogate between SVIs. Right?

It switches between ports (within the same VLAN), and routes between VLANs (using SVIs) or routed ports. STP is relevant for the former but irrelevant to the latter, which I was trying to point out above.

But this seems to say that it would cross SVIs.

However, switching ports all participate in a single spanning tree (for RSTP), and you need to configure them as you want things to work. You should note that RSTP is VLAN-agnostic and forms a single spanning tree. It works purely on the port level, as if you had an entirely 'flat' network.

I very much agree with this, and I think that's what I'm trying to do.

In your case, you should split the STP domains.

Shouldn't SVIs split the STP domains? That's what I thought would happen. If this is supposed to occur, I must have something incorrectly configured or the router is not being compliant (doubtful).

5
  • If you're talking about switches, not routers, then MST would be the most direct path to keeping the networks isolated. HOW would depend on switches involved. I've never seen a switch that allowed multiple regions. A and B would be their own region, while C would not be in either region.
    – Ricky
    Aug 26 at 4:21
  • 1
    Routers ROUTE, switches BRIDGE. Routers don't participate in STP. (switch modules in a router may) We really need to know what you're using, because routed interfaces do not process STP, they certainly will not copy them to other interfaces!
    – Ricky
    Aug 26 at 4:23
  • 1
    "This seems to say that STP would not propogate between SVIs. Right?" STP is a layer-2 protocol that does not propagate beyond the layer-2 Interface, and it will not be routed by layer-3. Only devices in the same layer-2 domain will use STP between them. Layer-3 connections do not use STP.
    – Ron Maupin
    Aug 26 at 13:41
  • You seem to be misusing this site. You are allowed one question per question. If you have further questions beyond your original question, you are supposed to start a new question. Remember that SE sites are explicitly not discussion forums or help sites, they are question/answer archives.
    – Ron Maupin
    Aug 26 at 14:12
  • @RonMaupin That's fair. I don't mean to be asking new questions, but rather, clarifying the original question, which still is not quite closed in my mind. But the problem could be with the person sitting in my chair :)
    – bwat
    Aug 26 at 16:48
2

Since you're using routers, ie. L3 forwarding, there's no need for RSTP/MSTP. xSTP is used to resolve loops for L2 forwarding using bridges/switches.

If you were using switches then you could consider using MSTP with multiple instances or even regions to separate different STP domains (to help you with that we'd not more information about your network topology).

As it is, simply turn off RSTP on the problematic ports using bpdu-filter and tcn-guard (depending on the devices at hand) - without multiple, bridged links towards network C, there's no danger of a bridge loop.

If you really want to keep RSTP active, at least use the root-guard option to avoid getting a root bridge you don't want.

Several questions were asked for if it's actually a router, and what device is it. It's a layer 3 switch/router. RuggedCom RX1512

If you're using an SVI (an IP address bound to a VLAN) then STP is active by default, even if there's just a single port in the VLAN. With only a single port in the VLAN, there's no need for STP and you can safely deactivate it there.

If you're using a routed (L3) physical port then STP should not be active on it.

Based on some of the comments and answers, it sounds like the RSTP BPDUs from one network should not be getting through the router and influencing the other networks. Comment from Ricky states: "Routers don't participate in STP. (switch modules in a router may)". This may be my situation.

Ricky is generally right, but a layer-3 switch is a combination of switch and (simple) router. It switches between ports (within the same VLAN), and routes between VLANs (using SVIs) or routed ports. STP is relevant for the former but irrelevant to the latter, which I was trying to point out above.

BPDUs do not go through a router, but they don't cross a (compliant) switch either. However, switching ports all participate in a single spanning tree (for RSTP), and you need to configure them as you want things to work. A switch isn't smart enough to make that decision for you by itself.

You should note that RSTP is VLAN-agnostic and forms a single spanning tree. It works purely on the port level, as if you had an entirely 'flat' network. In your case, you should split the STP domains. In other cases you could use MSTP instead and define regions to solve such a problem.

For completeness, MSTP also allows multiple instances to group VLANs into. That way, each VLAN is still guaranteed loop-free but not all VLANs need to use the same spanning tree as with RSTP.

Re Edit#2

BPDUs never cross between ports, for 802.1D-compliant switches, regardless of their configuration.[*] Each bridge ports participates in collectively building a spanning tree, originating, sharing and consuming information with the others.

[]* 'Dumb', non-compliant switches might actually forward STP BPDUs, but these consumer-grade things are off-topic here, and your L3 switch is no such thing.

RSTP always creates a single spanning tree, regardless of VLAN configurations. By default, MSTP does the exact same, in a compatible way with RSTP (RSTP ports participate in MSTP's common spanning tree CST). You'll want to split STP domains - do so by deactivating RSTP on the ports in question.

Shouldn't SVIs split the STP domains?

SVIs have no relevance for xSTP. You might be thinking of Cisco's proprietary RPVST+ which creates an independent spanning tree for each VLAN. But that's not the way IEEE xSTP works.

Regarding rings with Ethernet

You seem to be considering creating a ring in network A. That's fine for a routed network with an appropriate configuration, but a clear no-no for a bridged network. While small rings are not that much of a problem with xSTP, large one may quickly grow too large. xSTP is designed to handle a maximum diameter of seven bridges and may not converge reliably beyond that.

Also, rings tend to perform poorly compared to the same amount of links in a tree. Ethernet bridging requires a tree to work and you should build your network just like that: one core switch in the middle (or two for redundancy) and one (access) or two layers of switches (distribution and access) around that.

5
  • Thank you for the response. As I posted in my edit, it's a L3 switch. So what you stated was my original assumption as well. The network boundary would have served as the RSTP boundary. The connection to Network C may have multiple links in the future though, so I'm a little wary of turning off RSTP.
    – bwat
    Aug 26 at 11:48
  • @bwat With routed links there's no need for xSTP.
    – Zac67
    Aug 26 at 12:07
  • Thank you again for your detail responses. I posted edit. I tried to give up-vote to your answer, but it looks like I'm still too new.
    – bwat
    Aug 26 at 13:33
  • ethernet rings can be much more robust these days. (SPB, etc.) We have far better processes available than ages old STP blocking links. (not that a ruggedcom supports it.)
    – Ricky
    Aug 26 at 19:54
  • 1
    @ricky - Agreed - but SPB or possibly TRILL usually imply a hefty price tag. With that kind of hardware I'd normally use routed links with OSPF anyway. We've seen enough ring (mis)designs here, so the standard advice is stay clear.
    – Zac67
    Aug 26 at 20:02
0

What you have is a switch first, router a very distant second. Every port on it is a switched port, and will be participating in the same spanning-tree.

Options are limited:

  • disable STP on the "routed" port(s) - not recommended
  • make the port a non-switched port (no switchport) if possible - this will make it a routed port, and take it out of STP.
  • configure MST with each side in a different region - effectively partition STP (no need to configure any instances, but DO disable RSTP compatibility, if possible)
3
  • Why would you not recommend disabling STP on the routed port if doing 'no switchport' also turns off STP?
    – bwat
    Aug 26 at 20:03
  • @bwat no switchport changes the overall function of a port, not just STP. SVIs won't work any more and you'd need to reconfigure the port completely.
    – Zac67
    Aug 26 at 20:07
  • It doesn't just "no spanning-tree" the port, it removes it from the switch fabric, thus removing it from spanning-tree. It ceases to be a switched port and becomes a fully independent routed port. You can still have SVIs, and handle routing for VLANs, but that port will no longer be part of any SVI/VLAN.
    – Ricky
    Aug 26 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.