For the past few days i have been trying to get multiple VLan's working that are redundantly connected. One VLan would be connected through a controller and to the other switch. Then a second cable to make this connection redundant. Also, there are servers connected on both switches that need to communicate with all the controllers (on all VLans). And I cannot seem to get it to work.

So my first question is.. Is this even possible? And if so.. How would I go about this?

Here is an image of how I would want to create this network: Network I want to create

This network is a simple representation of the bigger network with more switches and more controllers. The normal connection for our controller is that they are connected between the switches and a cable from 1 switch to another. This is because we need it to be redundant in case 1 of the cables breaks, and we cannot afford a disconnection at any time. The reason we started thinking of VLAN's is because the traffic in our network is getting very large and out controllers are slowly reaching their limits.

Our entire network runs on a single subnet because that is how we identify all of our controllers in the network.

Edit: Our controllers also act as switches The controller ports are running RSTP. I have the VLAN setup so port 1 and 2 have a PVID of 10 and 3,4 of 20 (on both switches). The servers both have Tags of the VID 10 & 20.

Edit2: I have tried the setup with 2 VLAN's and 1 Trunk cable. RSTP. If I disconnect the trunk cable (on the left switch), the right server cannot connect (ping) the controller on VLAN 10 (the other way around as well). Disconnecting either VLAN cables does not affect the system.

  • You are talking about wireless controllers? Or what kind? Are the controller ports independent? Bridged? Participating in MSTP? Do you route in and out of each VLAN?
    – Zac67
    Sep 20, 2023 at 6:53
  • No just ethernet based controllers, custom made by us. As far as I know the controller ports are running RSTP. And i'm not sure what you mean by independent or bridged? Not sure how to take that, routing in and out of each VLAN. I have the VLAN setup so port 1 and 2 have a PVID of 10 and 3,4 of 20 (on both switches)
    – TomB
    Sep 20, 2023 at 6:56
  • Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers.
    – Zac67
    Oct 20, 2023 at 10:31

1 Answer 1


Our controllers also act as switches

If you create redundant links in a network, all switches need to either participate actively in RSTP/MSTP or to pass xSTP BPDUs unchanged (many dumb, unmanaged switches do).

Any switch filtering BPDUs without participating in xSTP can cause bridge loops go undetected, bringing down your network.

Also, you indicate multiple VLANs without explaining how they are routed. When you don't want the controllers in different VLANs to communicate with each other, the router is exactly the place to filter the traffic. You could use a layer-3 switch with ACLs or a firewall with an according ruleset.

Every component is within the same network

That isn't possible. Multiple VLANs mandate different IP subnets in order to enable routing. If you simply bridge two VLANs together they become one.

If the xSTP problem is sorted out, you could forget about different VLANs, put everything in a single subnet, and filter traffic between controllers on the intermediate switches (requires ACLs).

i'm not sure what you mean by independent or bridged?

Independent ports are just that - they use different MAC addresses and you can assign different IP addresses. Your Our controllers also act as switches answers that question - they are bridged.

As far as I know the controller ports are running RSTP.

You need to make sure. Usually there's at least some configuration for RSTP. At least, make sure the connected switch ports receive BPDUs from the controller ports.

RSTP interoperates nicely with MSTP (with MSTP's CIST). Unless you configure multiple MSTP instances, it "just works".

One general catch with RSTP and at least a potential one with MSTP is expecting full VLAN connectivity with redundant links that carry different VLANs.

RSTP is entirely VLAN agnostic. If you e.g. have two redundant links, one dedicated for VLAN 10, the other for VLAN 20, RSTP always blocks one of those link - interrupting one of your VLANs. The solution is to use full VLAN trunks, so connectivity is ensured with one link blocked. I think this is what's currently happening.

MSTP works the same way by default. However, it allows you to create multiple MSTP instances (MSTIs) and group your VLANs into those instances. Each instance creates its own spanning tree, so using different bridge/port priorities with the instances, you can arrange your trees so that traffic flows are as desired. Very often, that kind of configuration is not at all trivial.

Of course, with any kind of STP, you need to choose your root bridge (and failover root bridge) carefully by setting their priority to e.g. 0 and 1. If you leave that unconfigured, chances are that one of the controller becomes root, rendering traffic flows less optimal.

I think your best approach is to forget about VLANs and use RSTP/MSTP CIST to manage your redundant links. Most likely, traffic flows will not be optimal, but depending on the application that might not even be noticeable.

  • I have noticed with testing that such a setup gives me a connection on VLAN 10 but not on 20, is this then because it merges the connection on the VLAN 10 wire? I also tried a setup the MSTP to have an instance for VID 10 and VID 20 (2 VLAN's/Instances). We don't need the routing as our system exists by itself and no other external connections.
    – TomB
    Sep 20, 2023 at 8:49
  • I have just added the likely cause for your problem, as RSTP and default MSTP are VLAN agnostic - you can't mix redundant links and different VLANs with multiple MSTIs.
    – Zac67
    Sep 20, 2023 at 8:52
  • So my options would be to use RSTP with 1 trunk cable and 2 VLAN cables, or a more complex MSTP? Or are you suggesting to use no VLAN cables and only 2 trunks?
    – TomB
    Sep 20, 2023 at 9:03
  • You can keep the links, you just need to get rid of the VLANs. And use switches that allow you to block inter-controller communication (which I assume is the purpose of separate VLANs).
    – Zac67
    Sep 20, 2023 at 9:39
  • If there's no router: do the servers trunk the VLANs as well? Otherwise, each server can only talk to nodes within its VLAN...
    – Zac67
    Sep 20, 2023 at 9:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.