Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

IE3000 and IEM-3000-8FM= configuration

Hi,

I have a situation where number of ie3000 switches are connected in ring topology and i want to add a spoke switch with a fiber link in trunk mode .

lets say switch A has IEM-3000-8FM= module and one of the ports (lets say f2/1) on this module will be connected to gigaethernet (G1/1) port on the other switch with 100 mb SFP type.

- in global configuration i have #  spanning-tree bpduguard enable

- G1/1 is set to full duplex , trunk mode

when i set f1/2 on trunk mode i get both ports in err-disable state, after restarting the port it comes to not connected mode !

i reconfigured f2/1 as access port vlan x , now it works (the link is on although other side is configured as trunk !)

# sh interfaces status   gives that port f2/1 is on trunk mode

i will appreciate if somone explains to me why err-disable is happening at the beginning and how come that a port is configured as access port (# sh run gives that it is access ) behaves and operate as a trunk and without coming into err-disable state

regards

3 REPLIES
New Member

IE3000 and IEM-3000-8FM= configuration

How are you setting the parameters on each side for the trunk ports?

New Member

IE3000 and IEM-3000-8FM= configuration

first it was like that:

G1/1:  #  switchport mode trunk

          #   spanning-tree bpdufilter enable

          #   spanning -tree portfast trunk          ! i dont want the spoke switch to participate in STP !

f2/1 : 

          #  switchport mode trunk

          #   spanning-tree bpdufilter enable

          #   spanning -tree portfast trunk 

i got err-disable state with above configuration, after clearing the error (shut , no shut) both ports are comming to (not connected) state and stay like that.

when reading error log i see interface is gone to err-disable because of receiving bpdu packet with bpdu guard is enabled (global configuration for the switch on G1/1).

then i did this

G1/1:  #  switchport mode trunk

f2/1  :  #  switchport access vlan x

          #  spanning-tree portfast

Now it is working properly , when i issue (# sh interfaces status ) i got the port f2/1 as a trunk

i am not sure if above configuration is stable (port is sconfigured as access but operates as trunk)

New Member

IE3000 and IEM-3000-8FM= configuration

Well, if you have bpduguard enabled, then the port leading to the new switch you're adding is going to go in err-disable if the switch you add to the network has a lower spanning tree value then the current root bridge. This is the point of bpdu guard. Now, I see that you have bpdufilter enabled so I can't explain why a BPDU is being sent. Also, it appears dynamic trunking is kicking in.

If all your switches have the default spanning tree priority, the switch you're adding may have a lower mac address. Try raising the spanning tree priority for the vlans configured on the switch you are adding (if you are running a per-vlan spanning tree). Also, don't forget that vlan 1. A lot of people forget about vlan 1. Also, it's bpdu's don't go accross trunks tagged.

For my layer2 domains, I follow the following setup. I'm not saying this is the way to do it, this is just how I do it. Others may do it a different way. As always, test first in a lab any setup you plan to introduce into production.

On my root bridge:

spanning-tree mode rapid-pvst
spanning-tree portfast default
spanning-tree extend system-id
spanning-tree vlan priority 4096

On my backup root bridge:

spanning-tree mode rapid-pvst
spanning-tree portfast default
spanning-tree extend system-id
spanning-tree vlan priority 8072

On trunk ports:

  switchport

  switchport nonegotiate

  switchport trunk encap 8021q (may or may not be supported depending on your software version)

  switchport mode trunk

  switchport trunk allowed vlan add

  spanning-tree portfast trunk

Now, if I am going to connect a switch to another switch and I'm not going to use spanning tree, I will actually do a no spanning tree per each vlan on that switch. However, I keep very tight control over the ports on my network. I don't disable spanning tree on any switch users connect to. The only time I will disable spanning tree is if the switch I'm connecting will only be used for a special purpose. Also, I keep all non-user ports in my switch environment admin down.

Now, some people have much larger networks where this may be impossible. Therefore, keeping your layer2 domain consistant is very important. I like keeping control over which vlans cross trunks but some folks prefer a more dynamic setup.

 

230
Views
0
Helpful
3
Replies