0

Spanning Tree is blocking one of the ports on one of my Aruba J9773A switches.

How do I discover what port on what device is on the other end of the cable connected to that port?
It's probably one of many other Aruba switches in that location, I would like to know precisely which one.

What I've tried:

  1. List LLDP neighbours/remote-devices on that port: None.
  2. View the MAC address learned on that port: None.
  3. Looked over the spanning tree debug information, and other spanning tree logs: Didn't include what I'm looking for.

Is tracing the physical cable the only way to figure this out?

Improve this question
1
  • Without know a lot more about your network, I can't say. In general, ports being blocked are because of the thing directly connected to that port. Start there. (I have a sneaky feeling your network is too big [over 7 hops], but there are things that can "self-loop" traffic - VM's, etc.)
    – Ricky
    Commented Jul 11 at 16:57

1 Answer 1

Reset to default
1

I suspect a rogue root bridge has pulled the root port to an end-node port and any extra VLANs lose connectivity.

I'm afraid to locate that device you'd need to physically follow the cable...

  1. run show spanning-tree detail - check for actually received BPDUs on the relevant port
  2. run show spanning-tree root-history - check for any rogue root bridge
  3. double check the logs (show log | i port) for relevant events
  4. run a debug (debug mstp event & debug destination session) while connecting the suspect port
  5. debug destination buffer allows you to debug for a more extended time period, run show debug buffer on the next day or so

Additionally, there are a number of configuration options preventing any STP abuse, including:

  • spanning-tree <port> root-guard tcn-guard for end-node ports in general
  • spanning-tree <port> bpdu-guard for end-node ports to be disabled when a rogue bridge is connected
  • spanning-tree <port> bpdu-filter for end-node ports that you want to ignore BPDUs on - caution: disables STP and should be combined with loop protection

And of course: choose your root bridge wisely (spanning-tree priority 0), select a backup root bridge (spanning-tree priority 1) and do not accept roots on any other ports (see root-guard above).

If you run multiple MSTP instances, you define your (backup) root for each instance individually.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.