Cisco Switching/Routing :: Passing VLAN / Spanning-tree Between 2960S And 3750X
Oct 8, 2012
Has anything changed in the way of defaults for creating a trunk port and spanning-tree between a 3750x and the newer 2960s? I have one of each I just took out of the box and applied my standard switch configuration template but I cannot get my VLANs that are configured on my 3750X to appear on the 2960S. I find nothing that is blocking and everything seems to be forwarding and I am running out of things to check.
I am migrating an existing LAN from 3550 to 3750X-12S. In the existing configuation, I´ve got some trunks with native VLAN <> 1. The native VLAN is also used for user data transport. With IOS 15.0(1)SE3 on 3750X I recognized, that per default behavior PVST is not active for a VLAN defined as native, even if the corresponding trunk is up and trunking. My current workaround is to add a "switchport access vlan" command on the trunk even this one never should become an access port. With this statement only the switch is activating the PVST for the native VLAN. For all other vlans PVST works as exspected. [code]
I want to have an opinion that which switch shall I replace the Cisco 2960s with so as to elimintae the need for spanning tree in there but then what would be the design look like between Netscreen and those new switches. Also would it be vendor independant to work Between Cisco and Netscreens/Cuberguard.
Recently we will add 2 new core Switch 3750X, these 2 equipments will manage the spanning tree ( root)my idea is to change the priority in order to make 1 or the 2 of them the root, my question is if i setup the same priority for both when one go down the other will assume the role of root in the spanning tree topology ?
I have a 3750 switch which has the command 'spanning-tree vlan **'. I am struggling to remove this command, as this particular VLAN is one I want to distribute across our network.I have so far, set the switch to VTP Transparent mode and removed the VLAN from the database, this removes the command. If I then put the switch back to VTP client mode (or manually add the VLAN, while in in VTP transparent mode) then the command comes back. Submitting the command 'spanning-tree vlan **' command has no affect.
We have a pair of 6500 switches, each having a trunk going to each access switch. We set the spanning tree priority on Core1 so it is the root bridge for all VLANs. We have two different types of access switches:
-3550 setup as VTP client and ISL -2960 setup as VTP transparent and dot1q.
Pruning is disabled but we use "switchport trunk allowed vlan" to restrict which VLANs go through each trunk. When we need to permit a VLAN through a trunk, we simply run "switchport trunk allowed vlan add <VLANID>" on the access switch and both core switches. If it is a 2960 in VTP transparent mode, we must set the VLAN to active. Once this is done, a "show int trunk" will reflect the new VLAN in "Vlans in spanning tree forwarding state and not pruned" for Core1.
I recently went through this process to add VLAN 250 on a 3550 access switch, but the VLAN is not listed in STP forwarding state and not pruned. I tried removing the VLAN from the trunks and redoing it, but there is was no change. I tried adding VLAN 257, but the same behavior happened. I then tried trunking the same VLANs to a few other access switches. Three other 3550s experienced the same behavior, but I was able to trunk the VLAN to a few 2960 switches. At this point, I figured it might be related to some kind of limitation of VTP or the 3550 switches. I provisioned a new 3550 with the same IOS and settings (VTP client, ISL). To my surprise, all VLANs configured were in STP forwarding state and not pruned.
Running show spanning-tree on the core and access switch shows VLAN 250 as designated FWD. I confirmed we are not hitting the limits in "show spanning tree summary totals" on the Core or Access switches. I also confirmed we are not hitting the virtual port limit by running "show vlan virtual-port slot x."My next action might be to shut/no shut the uplink to Core1 from the access switch, but I'm not sure if that will fix it and even if it does, I have no clue what caused the issue.
I read that maximum spanning tree instance number is 128, is there any switches that can go more than128 instances ? or can we do this from IOS updates ?
..I am connecting a Nexus 5K to a 6509 without VSS. Is the recommended configuration just straight etherchannel? Since the 6509 cannot do vpc, is an etherchannel the best way to configure this uplink? How does spanning-tree operate.
i can't configure "logging event spanning-tree" on a specific port under IOS 12.2.(58) SE2 (all other "logging events" are possible), under 12.2 (55) it is possible. Is it now a known bug or a default value?
Why is it when I set the port priority for example to 8192 and I then do a show spanning-tree vlan 1 it shows as 8193, does it add the vlan number? so if it was vlan 10 it would be 8202?
I have two switches claiming to be the root bridge for the same vlans. The 3750-X stack was configured to be the root for vlans present and the 2960S was brought online over the weekend to replace another one. This is the command I used to attempt and make the 3750-X stack the root
spanning-tree vlan 1-2,10,50,101,200,900,999 root primary diameter 4 The IOS converted that to this spanning-tree mode rapid-pvst spanning-tree loopguard default spanning-tree portfast bpduguard default
I am about rip and replace my current 3750G stack with a 3750X stack. I have trunked over vlan and vtp info and implemented a config so it should be ready to go other then moving cables onto it. However one thing I want to correct with our current setup is that the root bridge on our vlans including vlan 1 is on a separate set of switches that we control, however I would like this new stack to be the root bridge for all of our vlans. It will be the central set of switches that all other switches trunk into. I have pre-set higher spanning-tree priorities for each vlan on the new stack so I expect as I move lines into it that the tree will be re-calculated with it as the root bridge. I've ensured that there are no root guards on any of the other switches trunks and priorities are all at default levels for each vlan. Should I enforce root guard on the trunk interfaces of the new master stack? Most of the trunks are port-channels to the other switches - do I need to set root guard on the Port channel interface or on the individual ports that make up the Port channel? On both? Any other recommendations in regards to implementing spanning-tree with the new stack? I know using port channels eliminates a lot of potential for loops but not every trunk is and I'd still like to have spanning-tree on.
A question concerning the use of REP for IE-3000-4TC switches:
In figure 14 of REP pdf URL can you explain why this creates a loop in the system? From the document, I thought REP and RSTP could talk to each other so why does this create a loop if they are exchanging information between each other? Also, if, in figure 14, the two switches in the STP domain that connect to the REP ring, were also connected to each other, would there still be a loop in the system?
Also, what is the recommended max diameter a REP ring should be. I thought I read some place 130 nodes is ok, but I'm looking to confirm this.
I am looking for some troubleshooting for some Cisco blade switches that are running high CPU. I have two 3020 blade switches in an HP chassis that each have two 1G links port channeled a pair of Nexus 5548s. Spanning tree has been constantly running about 35% of CPU for the last couple of weeks causing management SVI latency and CLI lag. The Port channel is the root port and the switches have no other connections.
Here are the things I have tried in troubleshooting the issue.
-Remove links from port channel so that one is forwarding and one is blocking -Removed the blocking link so that the switch only has one uplink. -Converted from pvst to rstp -Entered no spanning tree vlan <all vlans> so when you do show spanning tree there are no instances of spanning tree-Connected the single uplink to a different switch
Nothing has changed the continuous high spanning tree utilization of about 35%.
The 3020 switches server interfaces are configured as trunks for ESX running on the blades. It seems the only possible loop that could be causing this issue is on the ESX virtual switches, but I am not sure how that is possible. I say this because I have another pair of 3120s that have the exact same problem! However they were working fine (CPU normal) until the enclosure was populated and began switching traffic. After they began carrying a medium/heavy network switching load, the 3120s are running at a constant 56% spanning tree CPU utilization!
We will be connecting Cisco 4507 with Extreme Switches. We ran into spanning-tree issues last time. Extreme does not understand spanning-tree. So what i am thinking it to prevent bpdu advertisement from 4507 to extreme switches and also prevent incoming bddu from extreme switch to 4507. I am thinking of using
I'm testing debug spanning-tree functions in a lab, hardware is Cisco 6509 with SUP-720-3B and WS-X6748-SFP, IOS is 12.2.33.SXJ. It's a root in some vlan's, stp mode is rapid-pvst.I wanted to see how spanning-tree is working (STP packets dump, etc.), and entered following commands on 6509: [code]
Then, I turned the "debug spanning-tree all" mode on. Now, I expect to see BPDU packets from Cisco, and other spanning tree events in logs on syslog server, or in log buffer, but I don't get anyting there. Except, there're some lines in log (they repeat very rare): [code]
I have problems too when I connect 3com and Cisco.
I have 2 5500g 3com switches connected with 2 links. If LACP is disable, this causes serious problems and STP not works.
Logically , the link, is a port trunk with all the vlans permitted. One switch has STP enable and the other RSTP. Why this not works fine? I need to configure MSTP maybe? PVSTP is not allowed on this switches.
I'm having some weird issues with our 3560 that's connected to an MPLS line. The speed of the port plugged into the providers equipment is 100Mb, but we're only allocated 10Mb of bandwidth from them, I tried to police our traffic out of the port using srr-queue bandwidth limit 10, however when I do that I get some really weird bandwidth results.
Using iperf I've run bandwidth tests with srr-queue bandwidth limit enabled and with it disabled, when it's disabled I get the full 10Mb as expected, however once I enable it I'm lucky to get 5Mb, and while the test is running connectivity between sites is almost useless (which is not the case if I disabled bandwidth limit). Is there anything special I should be doing when I have this enabled? I also have priority-queue out enabled with only one dscp marking placed in queue 1, with very little traffic hitting that queue, but regardless of what I do I can't get the expected bandwidth with the bandwidth limit command, even if I place my iperf traffic in that priority queue.
I have been tasked with migrating 24 access switches from their current distribution switches, 2x stack 3750's to a their new 4500 distribution switches. Ideally with no downtime. My plan for this was to connect the 4500's to the 3750's and create replica vlans on the 4500's therefore spanning the L2 broadcast domain across both sets of switches.
Each one of the vlans that had been created on the 4500's would have the STP bridge priority set to 4096 and 8192. When one of the uplinks from the access switches to the old 3750 stack is connected to the 4500's, as I understand this should have a stp cost of 4 and move the old uplink into discarding therefor passing traffic across the new link. This would then allow me to disconnect the old link and connect it to the second 4500 as the L2 traffic is spanned between all switches. Not ideal but the only way I can see this working.
Once each of these switches have been moved, the SVI's and static routes will be moves from the 3750 stack to the 4500s.The problem I have is that I've ran out of the available STP instances I can use, these 3750's all seem to be at 128 already so as far as I know, is that if a loop was to be formed when the 128 allocation is hit this would indeed cause loop in the network.I have a total of in use vlans to be spanned of 700. I'm unaware how many instances of stp the 4500's can deal with however I can bet it's not 700. 3000 logical interfaces I believe is the maximum I can see online with regards to how many stp instances the 4500's can use.
May I know how to manually set the priority (root ID and bridge ID priority) and for spanning tree? Which one should I use based on the command below? and how does it affect the path cost of it?
My clients switch is running out of Spanning-Tree instances (c3560 only supports 128 instances). I know that running RSTP with VSTP can mitigate this that all instances over 128 will be handeled by RSTP, but before I implement this are there any other thoughts out there on how to mitigate this. Would MSTP be able to handle more STP instances or MISTP perhaps?
The network in my building consists of several 2950s connected back to 3550s using redundant fiber links and MST. Recently one tenant decided they wanted to run their own switch and use the existing building network for VoIP only which is on a dedicated VLAN. I was thinking about creating an access port on the 2950 and setting it to the VoIP VLAN as I do not want to give them a trunk port. The client can take this link and connect to their switch. So far does not seem to be an issue. Now what happens if the client configures spanning-tree on their switch? I have no control over their device and cannot manage it. Is there a way I can protect my edge switch and access port to allow them to run their own spanning tree without it interfearing with my existing MST instances? I was thinking BPDU guard but if they turn on stp and my switch sees a bpdu then the port is disabled and they lose VoIP access. At the same time I dont want them to be able to create a loop on their switch and have it affect mine. But since the is only a single cable from my device to theirs?
in my LAN the all access layer switchs/stacks are connected directly to core backbone switch (cisco 6509) via sfp fiber-optic, i want to protect my spanning tree setup with the "root guard" command.
1. where would i set this ? on uplink ports on access layer switches ? or on core backbone ports to which the access layer swithes connect to?. 2. can this be set on active (production) ports without downtime?
Our customer is willing to have a Cisco Nexus 5020 to provide server connectivity and this Nexus would go connected to their core switch 6509. They are concern about Spanning tree compatibility between the Nexus and the 6509. Are they fully compatible for Spanning tree?
I am getting ready to make changes to our spanning-tree configuration in the data center. In familiarizing myself with the network I noticed that our core switch (6509) wasnt the spanning-tree root for the datacenter.
When I enter the spanning-tree priority command on the central 6509, will it be a hitless change (i.e. will there be any disruption to the network) ? All switches are connected to the core/central 6509 by a direct connection.
I know that when I change from pvst to rapid-pvst that the network will bounce because of the change in configurations to all of the switches.
My colleague and I have been having a discussion about using rapid spanning tree in the access layer. Most of our infrastructure has been migrated to a routed access layer with 3750s.
The idea was brought up to configure the switches with rapid PVST. On the surface, it seems like a better idea, faster convergence, in the event that spanning tree ends up being used for some reason. My colleague prefers sticking with standard PVST. His argument is that, in the event of a layer 2 loop, some consumer-level switches filter out BPDUs and if the control plane is overwhelmed, the shorter timers of rapid PVST just puts that much more of a burden on the CPU trying to regain control, whereas with standard PVST it will have around 20 seconds before it starts to engage. (It may still be overwhelmed, but the longer timer delays the additional burden.) He says he's seen this problem with rapid PVST and that his opinion is backed up by our Cisco rep. (I haven't spoken to him yet.)
In our model, it should be very rare -- pretty much never -- that we would layer 2 span another switch off of our access stack.
One suggestion I saw is to use BPDU Guard, which is a good suggestion as well.
But we have had experiences with overloading the control plane on a 3750. I believe that concern is valid. If the CPU can't service spanning tree. But I'm interested in hearing about other experiences people have had in terms of rapid spanning tree in the access layer, end users plugging in unauthorized devices and creating loops, and the effects when using rapid spanning tree vs standard spanning tree.
I have a Cisco 3560 running as a Level3 device in my network running 10 V LANs and routing between most of them (nothing complex with ACLs) and running spanning-tree mode pvst. The main network is run on a net gear GS748TPS stack of three switches running MSTP.
I have just bought an additional 3560 and a 2960 to plug in. I have set them up with IP addresses and then plugged them into the net gear. This brought the whole network down until I unplugged the new switches.
I have confirmed the IP addresses aren't duplicated and that DHCP is not running on the switches so I can only assume it's something to do with DHCP. I cannot afford for the network to go offline again, so is there anything I should check? Am I running incompatible spanning tree methods between the net gear and Cisco devices?
At a college I'm trying to setup a Cisco 2960 to be used on a VLAN 248 tagged on the uplink port that uses Spanning Tree/. Here is the following from the Cisco:
show interfaces trunk
Port Mode Encapsulation Status Native v lan Gi0/1 on 802.1q trunking 1
Port V lans allowed on trunk Gi0/1 248 [code]...
On the Alcatel OS6850-48L the following is setup: bridge 1x1 248 priority 3287 Vlan 248 802.1q 5/8 "cisco"
I cannot make a change on the Alcatel, I can only administer the Cisco. I was able to get things working fine (as a test) using a Net gear or HP switch instead of the Cisco. However we have a Cisco switches and would not like to have to buy HPs. Is there a compatible spanning tree protocol to use on the Cisco with the way things are configured on the Alcatel. I need to stick to standard RSTP (802.1w) ieee standards and not something Cisco proprietary.
We are upgrading out internal office network. I have setup 4 switches and 1 router using the following config.
-2 SGE2010p's are stacked together forming vlan 30 (to be used for phones)
-2 SGE2010's stacked for workstation's under vlan 20
Both switches are apart of vlan 1 (the default)Ports 1 on each stack are connected to a Cisco 890 (port fe2 and fe3) in trunk mode. Ports 2 and 3 are in an LAG group and connected to the neighboring stack (I have attached a diagram), and are also in trunk mode).At this point one port (port 1 on either stack) goes into blocking mode, and I get why ,it's a physical loop.I need more than a 100mb link between switches (which is what pulling the LAG between switches gets me), but I don't want to route phone traffic through my workstation switches to get out of the LAN.Is it possible using these switches and router to have a LAG between stacks and a link to the router for traffic to 0.0.0.0 ?
2960 switch stack (flex) Spanning tree re-calculate from stack port one?I need to identify with port in the stack is causing the re-calc I have four 48 port switches and show spanning detail only indicates stack port 1.
I have a site that is very dense, but not high throughput. I have 4x48 port switches all 3560 and 1 2851 router. The switches are pretty much full to the brim but the site is never completly lit, they just like to move around a lot. However i wanted to provide this site with as much redundnace as possible. So my first thought was to build redundant pathing with the switches so that they could loose a switch and not have a single point of failure. So therefore I built a ring. SW1 to SW2, SW2 to SW3, SW3 to SW4, SW4 to SW1. To make this even more redundant against port hardware failure, i used two uplinks for each and built an etherchannel. is it good practice to use Etherchannel and Spanning Tree together?So i now have a good redundant LAN switching topology. I have multiple VLANs at the site so I am using Rapid-PVST. I did not set priorities on the switches as I don't think that is really truly necessary, but correct me if I am wrong!Ok so next step is to make sure that my WAN connection for all of these switches is redundant. I have a 2851 router, with 1 of the built in interfaces dedicated to our ethernet hand-off WAN connection (MPLS in this case using BGP routing). The other would be used as an uplink. I also got an additional card for the Router so that i can have redudant local LAN connections. I then built up some IRB bridges so that I could uplink the Router to SW1 and SW3. Is it good practice to use IRB Bridging on a Router to provide redundancy?So at this site i have the first part running, and it works pretty well but I have had 1 strage issue, which has to do with after a failure and re-convergence of spanning-tree, it seems that DHCP starts failing to work. I actually had to go into each of my switches make a dummy VLAN interface and put on helper-addresses to get them to work. They are not L3 switches (programatically speaking) so they should just forward the broadcast packet onto the router, which DOES have the helper-addresses programmed,Also at another site I have the bridge router setup configured, just without so many switches, and no etherchannel between the switches. This seems to work flawlessly, but the site is very small so performance issues would be difficult to spot since they are just thin-clients coming back to a Citrix server over a single T1.
