STP on Parking VLAN?

[devils_advocate]

Hello

This is likely an 'oh yes of course!' type question but I can't seem to figure it out...

This is a lab environment that I am rebuilding from scratch, its not production.

I have a 'Parking' Vlan for Unused and Shutdown ports on Access Switches.

My Distribution switches are the Spanning Tree Root (Rapid-PVST) for all VLANS

The Parking Vlan is not allowed on the trunk links, i.e manually pruned so presumably the BPDU's are not being forwarded?

All the L2 access switches seem to be becoming the Root bridge for Vlan 666, as does the distribution switch.

Now, I am thinking this is because Vlan 666 is not allowed on the Trunks, meaning the BPDU's are going nowhere and each switch is electing itself as the root for that vlan right?

So, if thats the case, is this best practice as both uplinks from each L2 Access switch are in the forwarding state for that Vlan?

I thought it was best not to have the Parking Vlan allowed on the trunks??!?!

Am I going mad (probably)?

Ta

[Peter Paluch · Accepted solution]

Hi,

What you have observed is completely correct - each switch is isolated to just itself with respect to the Parking VLAN, so each of them elects itself as a root bridge.

The best practice would be not just to prune the Parking VLAN from trunks, but to actually deactivate it on your access switches. This way, even if two or more hosts get connected to ports in the Parking VLAN on the same switch, their communication will be discarded.

If you are using VTP then you can deactivate the Parking VLAN domain-wide as follows:

vlan 666
 state suspend

If you have your switches in VTP Transparent mode, you can also use the same command, or the same result with just a switch-local impact can be achieved with

vlan 666
 shutdown

(The state suspend is propagated via VTP, the shutdown command is not; if you are not running VTP then the difference between these two approaches is irrelevant.)

Because the VLAN will be suspended, no STP instance will be run for it. Give it a try!

Best regards,

Peter

[devils_advocate]

That makes perfect sense, thanks Peter!

I was not aware you could suspend a Vlan and prevent it running an STP instance.