Spanning Tree Best Practice Between Sites

Mokhalil82 · ‎03-11-2015

Hi Guys

I have a topology where there are 3 main sites, each site has its own VSS Pair. The sites are connected to each other in a triangle fashion with 1G Ethernet Links between them. Now some vlans stay at each site and others span between the sites. RPVST is the spanning tree protocol running.

I am trying to find any weaknesses in the spanning tree and just want to know what are cisco best practices in this scenario. I have looked at spanning tree at a single site with one core and know how that would be setup, not sure about this one

Any help will be much appreciated.

BTW I am not trying to use spanning tree, but making sure it is there as a backup and works if needed

Thanks

Peter Paluch · ‎03-11-2015

Hi,

I think that Cisco's foremost best practice on this would be to have the interconnections routed, not switched, and never allow a VLAN to span from one site to another. However, I do not know if this change can be implemented in your network.

So obviously, if there is a VLAN that contiguously spans all three sites then STP is a must. Running RPVST is a good choice. Personally, if your switches support it, I would recommend running the Bridge Assurance on all inter-site connections to make sure that whenever your provider screws something up and BPDUs get lost or filtered, the inter-switch links get blocked. If the Bridge Assurance is not supported then at least run the Loop Guard.

Also make sure to manually prune (disallow) all unneeded VLANs on the trunks between the three sites. Leave only VLANs that span from one site to the other allowed on these trunks.

I hope other friends here will add their own views/suggestions.

Best regards,
Peter

Jon Marshall · ‎03-11-2015

I agree with everything Peter says.

I just wanted to add that as far as the design goes if the switches form a triangle then there is a very good chance you will get suboptimal traffic paths because if you have a vlan(s) that spans all sites one of those links has to block and it may be the direct link.

Which means traffic has to go the long way round. This is not just for L2 traffic ie. between clients in the same vlan but depending on the placement of the SVI for that vlan it could also be L3 traffic as well.

Do you need the same vlan at multiple sites ?

There are good reasons sometimes to do it but just as often it isn't really needed and you can route between sites.

Jon