RPVST+ at Distribution and PVST at Access Switch

Hi. I have two Cat6506 (redundant collapsed-core config) configured w/ RPVST+ and connected to this are a series of Cat2950s configured with PVST. My question is, is this a good practice configuration of STP? (running both RPVST+ and PVST on the same topology) Will there be any problems with convergence? We recently are adding some vlans on the network and we experienced an outage for most of the vlans. The Cat6500s registered duplicate HSRP addresses. Any recommendation to fine-tune this network (considering that the Cat2950 does not support RPVST+) would be helpful. thanks.

you can run rpvst+ and pvst+ simultaneously.
rpvst+ has been built to interoperate with pvst+.
an rpvst+ configured switch will revert to pvst+ in a pvst+ rootBridge scenario.
cisco recommends a slightly different configuration in this case:
1) run two STP instances, one for rpvst+ and one for pvst+.
2) the rpvst+ instance must have an rpvst+ switch as the rootBridge; the pvst+ instances must have an pvst+ switch as the rootBridge.
3) keep the pvst+ switches at the edge of the network; likewise, keep the rpvst+ switches at the core of the network.
please see this link for more info on STP modes:
http://www.cisco.com/en/US/products/hw/switches/ps5213/products_configuration_guide_chapter09186a0080216672.html#wp1150156
please see the following link for much more STP info:
http://www.cisco.com/en/US/tech/tk389/tk621/tsd_technology_support_protocol_home.html

Similar Messages

SAN design : core edge and dual-homing access switch

Hello all.
It may sound as a dumb question (from a LAN guy) but when designing a core/edge or edge/ecore/edge design, why do we connect access switches to both core switches ? Doesn't it break the isolation of a dual fabric backbone ?
If an access switch fails the fault (bug or anything else) will propagate to both core switches ? Am I wrong ?
Example :
http://www.cisco.com/en/US/prod/collateral/modules/ps5991/prod_white_paper0900aecd8044c807_ps5990_Products_White_Paper.html
or from netrworkers sessions in 2006

Answer also from LAN guy,
Most likely this design diagram is due to assumption that there is no use of VSANs and SAN Multipathing drivers in host.
Following is excerpt from same like yo posted.
"SAN designs should always use two isolated fabrics for high availability, with both hosts and storage connecting to both fabrics. Multipathing software should be deployed on the hosts to manage connectivity between the host and storage so that I/O uses both paths, and there is non-disruptive failover between fabrics in the event of a problem in one fabric. Fabric isolation can be achieved using either VSANs, or dual physical switches. Both provide separation of fabric services, although it could be argued that multiple physical fabrics provide increased physical protection (e.g. protection against a sprinkler head failing above a switch) and protection against equipment failure. "

Why access switch has flapping lead another distribution layer switch has root guard blocking and unblocking log

is it misconfiguration in Access Point's access switch or hacker attack from this switch?
many MATM-4-MACFLAP_NOTIF Host 0015.5dc1XXX VLAN 1 is flapping between port 1 and port 2
many MATM-4-MACFLAP_NOTIF Host 0015.5dc2XXX VLAN 1 is flapping between port 1 and port 2
many MATM-4-MACFLAP_NOTIF Host 0015.5dc3XXX VLAN 50 is flapping between port 1 and port 2
many MATM-4-MACFLAP_NOTIF Host 0015.5dc4XXX VLAN 50 is flapping between port 1 and port 2
last time we do not have these switch also meet the same issue about distribution layer switch have many ports down
last time someone mention a switch lost config, but today, i remember that the switch has reloaded and can be login again with radius,
today i do not connect any notebook with this switch and just have configured radius setting for window NPS radius server and then reload, then
i have dinner and come back and after a while, last time's issue happen again.
it seems port channel easy to have problem when abnormal traffic coming from access switch result in down port in distribution layer switch
i wonder whether someone can hack through the switchport access mode port and send some broadcast message

From that output and your description it looks like you have an STP issue as a result of misconfiguration somewhere.
Are your access points connected to switches with ports in access mode or trunk mode?

Form Layer 2 to Layer 3 on Distribution and Access

Hi,
Our LAN topology have Core "L3" , Ditribution "L2" and Access "L2". We want to get rid of spanning tree by moving from layer 2 to layer 3 on Access and Distribution layers.
My questions is:
1) Any advice/document on this?
2) in the access switches did I have to configure each interface on 3750 as routed port by issueing "ip routing" and giving an IP address of each port ????. if this is the case than I will need huge amount of IP addresses.
Thanks

Hi
Much of this has already been covered off.
Just to add, I have implemented both routed access-layer and L2 access-layer and each has advantages and disadvantages.
Major advantages for L3
1) STP contained with wiring closet. Yes you can use RPVST+ but you still are extending L2 links between the distribution and access-layer with all that implies eg broadcast traffic. In addtion to utilise both uplinks at the same time requires a lot of extra configuration ie. setting root bridges for odd and even vlans and matching that to active HSRP gateways etc.
2) Automatic equal cost load-balancing (see previous point )
3) Easier troubleshooting. As previous poster said this is a matter of opinion and i have more experience with switching to be honest but i think troubleshooting L3 routing problems is generally easier than L2 STP problems.
Disadvantages
1) Vlan's cannot be extended across floors. May or may not be a problem for you.
2) If your distribution layer utilises 6500's with service modules eg the Firewall Service Module then layer 2 links give you more flexibility in deployment.
3) Cost can be an issue although your 3750's would support EIGRP stub functionality with only the base image.
As another poster pointed out, STP has come a long way from it's 50 seconds failover and with the correct setup it is nowhere near as important that you try and remove it.
I am just as much in favour of L2 access as L3 and most of major sites utilise L2 from the access-layer but with the speed/performance and cost of L3 switching you can get nowadays using L3 is a viable alternative.
HTH
Jon

High Latency and Patket drop towards Access Switches.

Hi,
My network Infrastructure consists of 2 core switches(cisco 3950, 24 port) and 3 access switches (cisco 2960G, 48port). No distribution layer.Both Core switches are connected to the BVI of a VPN router.PVST is running in all switches. The STP results are all good. We have 3 VLAN's in the LAN an IP routing is enables in the core switch. The network diagram is attached.
The issue we are facing is that , we get intermittent packet drops while pinging towords the access switches, and there is always a higher latency towords these assess switches.These issues are present even with no other users using the LAN. But these issues are not present while pinging towards the GW.
I guess, it is because of this, we have issues the accessing file server in the LAN. How do we go ahead with the troubleshooting. Will upgrading the IOS help resolve this.The present version details is..
WS-C2960G-48TC-L 12.2(44)SE6 C2960-LANBASEK9-M
Thanks in advance for the help.

Hi,
Do you still have this problem of is it solved?
i have the same kind of issue, so any help or information is welcome!
Tom

Spanning vlans across access switches in distribution block.... please help

Hi All
Can someone please explain why Cisco states that in a Campus Hierarchical modle if Vlans are spanned across Access switches in a distribution block, then the Distrubution to distribution link should be Layer 2. Is this really necesary or just a recommendation, and if so why? Can't this link be a L3 link when spanning vlans across Access switches in distribution block, as I understand the benefit of having a L3 distribution to distribution link so that SPT is avoided.
Please help

Hello,
The cisco recommended design is L3 links, but these is only possible if you have no vlans you need to span over the hole network.
It depends on your topology or what you want achieve.
If you need for one or more vlan's spanned the LAN, you need to use a layer 2 connection between all switches and between distribution too.
In my company we have for example a few vlans for restricted areas, like device management or else, so we can't use L3 Links in the distribution area because these vlan's are terminated at the firewall. I think these is good thing.
I would recommend you if you don't have to span one or more vlan's across the network to use L3 Links, specially in the case of redundancy way's. So you need no spanning-tree, but need to use other protocols like GLBP or else. The works faster and are not so confusing (for some people) as STP.
best regards,
Sebastian

What are the major differences between a Access Switch and Aggregation Switch w.r.t Carrier Ethernet domain?

In a Carrier Ethernet domain,Could someone please help me understand what's the basic difference between Access Switch and Aggregation Switch both in terms of s/w and h/w functionalities. MEF deals OAM,CFM, EVC provisioning only at the access edge switches. Do we need to repeat all these at the aggregation level? or is it just used for routing purpose? Do we have a separate Fault Management at the aggregation level?

Duplicate posts. :P
Go here: https://supportforums.cisco.com/discussion/12137156/what-are-major-differences-between-access-switch-and-aggregation-switch-wrt

Grant access to help desk users to add members to distribution and security groups

Hello,
I am trying to create a set of help desk users that has full access to add or remove members from distribution and security groups as well as update users. We want it to bypass owner approval and essentially allow this group to add or remove members
in the FIM Portal and flow it down to ADS.
This obviously works fine if one is a member of the Administrators set, but we want a second tier of power users with limitied rights compared to FIM Admins. We have added the help desk team to the Security Group Users and Group Users set as
well as MPR "Security group management: Users can read selected attributes of group resources".
The help desk users can update users in the Portal with no issue. The can search groups with no issue but when they try to add members to a group they get the error "Access Denied".
Any help is greatly appreciated.
Thanks!

I'm having very similar problem - I have users with delegated right to modify group membership only. User can add someone to group and it works fine, but when the same user is trying to remove and user from a group (even if this is the same user
which was added a minute ago) he gets Access Denied:
The
request included members which the requestor is not authorized
to add and/or remove from this group."
It is caused by default MPR:
Group management workflow: Validate requestor on remove member
Question is how this activity validates this request - any insight?

[solved] DHCP snooping in environment with core and access switches

Hello,
I'd like to know what steps are needed to configure DHCP snooping in my environment:
1) two core switches Catalyst 6500 (VSS): VLAN defined here, DHCP server connected here
2) access switches Catalyst 3750: clients connected here
Access switches are connected to core ones via trunk ports (fiber optics).
How many snooping databases are required? One for core and next for each stack?

Hi Marian,
If your network is properly designed and connected so that clients, including DHCP clients, are attached to the access layer switches, then the DHCP Snooping should be run only on access switches. Running DHCP Snooping on core switches is not going to increase the security because the DHCP communication has already been sanitized on the access layer.
If you intend to save the DHCP Snooping database then each switch performing the DHCP Snooping needs to have its own database if you intend to use a persistent storage for it. However, you can always have the switch to save the database to its own FLASH, alleviating the need for a centralized networked storage.
I am not sure if this answers your question so please feel welcome to ask further.
Best regards,
Peter

IMessage won't activate my cellphone number. I have tried rebooting and turning the iMessage switches on and off. I still have data bundles and am able to access all social media platforms except iMessage. Why won't it activate my cellphone anymore? Help!

iMessage won't activate my cellphone number. I have tried rebooting and turning the iMessage switches on and off. I still have data bundles and am able to access all social media platforms except iMessage. Why won't it activate my cellphone anymore? Help! Does anyone know any fixes for this problem ?

See if this helps: http://support.apple.com/kb/ts4268

My Acer Switch 12 keyboard has quit functioning and I cannot access Bluetooth through the settings.

My Acer Switch 12 keyboard has quit functioning and I cannot access Bluetooth through the settings. Please help

fdbiker,
Depending on what your warranty period still looks like I would suggest service.
Here is the link to set up repairs online, or you can chat online with a technician (available 24/7)

HSRP between 2 access switches and 2 core switches

Hi I am looking for running HSRP between 2 access switches and 2 core switches for client PC and Server network’s next-hop redundancy as per attached setup.
As you can see I have used one /29 network for connecting CORE & ACCESS switches & configure Interface VLAN10 (Layer 3 SVI) with shown IPs and standby IP (VIP).G0/1 on Access Switches & G2/1 on Core Switches are access ports for VLAN10.
There is a L2 Trunk interconnecting Core-Main/Backup & as well as Access-Main/Backup Switches allowing VLAN10 to allow VLAN10’s HSRP packets to pass through (apart from other HSRP instances).
Below are the HRSP & Trunk configuration on Core and Access Switches please have a look and suggest if they are correct in term of HSRP implementation, as I can see on both side HSRP master & standby status are fine as desired, but I can’t ping VIP of ACCESS Switch from CORE switch, but the VIP of CORE switch I can ping from ACCESS switch.
Access-Main
interface GigabitEthernet0/1
description ***Connected to CR-SW-01 PORT G2/1***
switchport access vlan 10
switchport mode access
load-interval 30
interface GigabitEthernet0/2
description ***Connected to AC-SW-01 & AC-SW-02 for HRSP***
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,40
switchport mode trunk
load-interval 30
interface Vlan10
description ***Connected to CR-SW-01 PORT G2/1***
ip address 10.10.11.1 255.255.255.248
standby 1 ip 10.10.11.2
standby 1 timers msec 200 msec 750
standby 1 preempt delay minimum 180
standby 1 authentication accvlan10
Access-Backup
interface GigabitEthernet0/1
description ***Connected to CR-SW-02 PORT G2/1***
switchport access vlan 10
switchport mode access
load-interval 30
interface GigabitEthernet0/2
description ***Connected to AC-SW-01 & AC-SW-02 for HRSP***
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,40
switchport mode trunk
load-interval 30
interface Vlan10
description ***Connected to CR-SW-02 PORT G2/1***
ip address 10.10.11.3 255.255.255.248
standby 1 ip 10.10.11.2
standby 1 priority 10
standby 1 timers msec 200 msec 750
standby 1 preempt delay minimum 180
standby 1 authentication accvlan10
Core-Main
interface GigabitEthernet2/1
description ***Connected to AC-SW-01 PORT G0/1***
switchport access vlan 10
switchport mode access
load-interval 30
interface GigabitEthernet2/2
description ***Connected to CR-SW-01 & CR-SW-02 for HRSP***
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20
switchport mode trunk
load-interval 30
interface Vlan10
description ***Connected to AC-SW-01 PORT G0/1***
ip address 10.10.11.4 255.255.255.248
standby 1 ip 10.10.11.5
standby 1 timers msec 200 msec 750
standby 1 preempt delay minimum 180
standby 1 authentication crvlan10
Core-Backup
interface GigabitEthernet2/1
description ***Connected to AC-SW-02 PORT G0/1***
switchport access vlan 10
switchport mode access
load-interval 30
interface GigabitEthernet2/2
description ***Connected to CR-SW-01 & CR-SW-02 for HRSP***
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20
switchport mode trunk
load-interval 30
interface Vlan10
description ***Connected to AC-SW-02 PORT G0/1***
ip address 10.10.11.6 255.255.255.248
standby 1 ip 10.10.11.5
standby 1 priority 10
standby 1 timers msec 200 msec 750
standby 1 preempt delay minimum 180
standby 1 authentication crvlan10

Hi Rick thanks once again, so I am assuming I should use to configure as below and still one /29 subnet I can use to connect these Switches with the above static routings.
Access Switch-Main
interface Vlan10
description ***Connected to CR-SW-01 PORT G2/1***
ip address 10.10.11.1 255.255.255.248
standby 2 ip 10.10.11.2
standby 2 timers msec 200 msec 750
standby 2 preempt delay minimum 180
standby 2 authentication accvlan10
ip route 192.168.20.0 255.255.255.0 10.10.11.5
Access Switch-Backup
interface Vlan10
description ***Connected to CR-SW-02 PORT G2/1***
ip address 10.10.11.3 255.255.255.248
standby 2 ip 10.10.11.2
standby 2 priority 10
standby 2 timers msec 200 msec 750
standby 2 preempt delay minimum 180
standby 2 authentication accvlan10
ip route 192.168.20.0 255.255.255.0 10.10.11.5
Core Switch -Main
interface Vlan10
description ***Connected to AC-SW-01 PORT G0/1***
ip address 10.10.11.4 255.255.255.248
standby 1 ip 10.10.11.5
standby 1 timers msec 200 msec 750
standby 1 preempt delay minimum 180
standby 1 authentication crvlan10
ip route 192.168.40.0 255.255.255.0 10.10.11.2
Core Switch -Backup
interface Vlan10
description ***Connected to AC-SW-02 PORT G0/1***
ip address 10.10.11.6 255.255.255.248
standby 1 ip 10.10.11.5
standby 1 priority 10
standby 1 timers msec 200 msec 750
standby 1 preempt delay minimum 180
standby 1 authentication crvlan10
ip route 192.168.40.0 255.255.255.0 10.10.11.2

I have a new computer, and a new iTunes. My old computer crashed and I cannot access the harddrive. How can I switch over my iPod and iPad to my new iTunes?

My laptop crashed and I cannot access the harddrive. How can I transfer everything to my new iTunes to be able to sync my products with having to "erase" and start from scratch on evrything? Any insight will be greatly appreciatted! Thank you!!

Your iPad is married to its now deceased old computer. This is the reason for the necessity of a backup for your computer, which your iPad is not.
Your iTunes Store and App Store purchases will not be lost. Just don't "erase and sync" when you sync your iPad to your new Mac:
If you want to move the iTunes Store purchases on your device to the new computer, choose "Transfer Purchases." The new computer must be set up with your iTunes Store account and authorized to play your iTunes Store purchases in order to transfer your iTunes Store purchases.
Read this for more information:
Using iPhone, iPad, or iPod with multiple computers

Mono spanning-tree and PVST

Refering to these two links
http://www.cisco.com/en/US/tech/tk389/tk390/technologies_tech_note09186a0080094665.shtml
http://www.experts-exchange.com/Hardware/Routers/Q_21349385.html
IEEE 802.1Q defines a single instance of spanning tree running on the native VLAN for all the VLANs in the network which is called Mono Spanning Tree (MST). This lacks the flexibility and load balancing capability of PVST available with ISL. However, PVST+ offers the capability to retain multiple Spanning Tree topologies with 802.1Q trunking.
IEEE 802.1Q defines a single instance of spanning tree running on the native VLAN for all the VLANs in the network which is called Mono Spanning Tree (MST). This lacks the flexibility and load balancing capability of PVST available with ISL. However, PVST+ offers the capability to retain multiple Spanning Tree topologies with 802.1Q trunking.
http://networking.ringofsaturn.com/Certifications/BCMSN.php
Per-VLAN Spanning Tree (PVST) ? A Cisco proprietary method of connecting through 802.1Q VLAN trunks, the switches maintain one instance of the spanning tree for each VLAN allowed on the trunk, versus non-Cisco 802.1Q switches which maintain one instance for ALL VLANs. This is the default STP used on ISL trunks.
http://www.informit.com/content/images/1587051427/samplechapter/1587051427content.pdf
The 802.1Q standard defines one unique Spanning Tree instance to be used by all VLANs in the network. STP runs on the Native VLAN so that it can communicate with both 802.1Q and non-802.1Q compatible switches. This single instance of STP is often referred to as 802.1Q Mono Spanning Tree or Common Spanning Tree (CST). A single spanning tree
lacks flexibility in how the links are used in the network topology. Cisco implements a protocol known as Per-VLAN Spanning Tree Plus (PVST+) that is compatible with 802.1Q CST but allows a separate spanning tree to be constructed for each VLAN. There is only one active path for each spanning tree; however, in a Cisco network, the active path can be
I could not get exactly what these Terminology (PVST, instance, PVST+, MST, etc) trying to achieve ?
Any URL and online resource help me to do some extar reading to clarify these terminology

Hi,
The URLs that you have provided all explains the same technical details in different fashion.
I will summarise them here for better clarity.
There are two separate technologies that needs clarity.
1) Method of Trunking many vlans across a link
2) Spanning tree
Now for point 1, we have the IEEE standard 802.1q, which mentions how multiple vlans can be carried across a link. As per this standard a 4 byte tag will be inserted in the ethernet packet, ( inserted between the Destination mac address field and the ethertype field)
This tag will contain the vlan identifier info and some other details ( available in the urls that you have highlighted)
Cisco has a proprietary technology called ISL which effectively does the same job in a different fashion but can only be used in cisco devices.
Now for point 2, again we have IEEE standards like 802.1d ( common/mono spanning tree), 802.1w/RSTP ( Rapid spanning tree) and 802.1s/MSTP.
In 802.1d, there will be only one spanning tree process/instance running for the whole network, irrespective of how many vlans are involved in the network. Hence the whole network is treated as one common domain by the STP protocol.
So, there can be only one root bridge in the network and other bridges will intelligently block the redundant links, we wont have much control to effectively utilise the redundant links.
IEEE 802.1w/RSTP also works in the same fashion, but the convergence time is very fast in this protocol.
Here also there is only one spanning tree instance involved.
In both the above STP protocols, there is only one instance/process of the protocol running in the network, which is common for all vlans. Hence these protocols consume only very less CPU utilisation.
In 802.1s/ MSTP ( multiple spanning tree), extends the 802.1w Rapid Spanning Tree Protocol (RSTP) to have multiple STP instances. In this protocol, we can group the desired vlans in to one Instance of the protocol.
Say for example, lets assume a typical campus network with multiple access switches, 2 distribution/core switches.
Access switches having dual connectivity to the distribution/core switches.
In this topology if we deploy 802.1d or 802.1w, the redundant links from the access switches to the distribution/core switches will be blocked. Only one uplink from the access switch to the distribution layer will be working at any point.
In this network, only one distribution/core switch will be root bridge for the entire network.
But if we deploy 802.1s for this network, we can design it as follows.
We can split the vlans in to two groups,
Group1 => vlan 1 to 50
Group2 => vlan 51 to 100
We can create two instance of MSTP protocol with the following mappings
Instance 1 => for Group 1, with one distribution/core switch as the root bridge
Instance 2 => for Group 2, with another distribution switch as the root bridge
--Continued

Vpc and pvst+

How are vpc and pvst reconciled? Normally, a switch sends a BPDU toward the root bridge, but with vpc, both uplinks are supposed to be active....so what then? Does the STP secondary have to use the crisslink to send to the root?

"In any STP environment the root bridge is only so a loop free topology can be created. Once the network is stable it does not mean that all traffic must go via the root bridge. It can take the shortest path to the destination.
This doesn't just apply to Nexus, it is with all switches."
Without spending cycles over thinking this statement and trying to find a scenario that matches, let me concede that youre right, but this is not typical. In 99% of environemnts in a data center, you have a very typical multi-tiered architecture. You know...the usual stuff... access switches dual homed (typically, not always, I know) to a pair of distro switches that may or may not act as the L2/L3 boundary. The L3 boundary at distro is what Im thinking of now.
[EDIT - 10 minutes later] - Just thought of a scneario that describes what youre saying....an access switch dual homed to a pair of distros which are then uplinked to a pair of cores which act as root bridges for all the vlans as well as the L3 boundary. A host is hanging off of one of the distros. The frame will head in the direction of the root bridge in the core BUT get diverted to the distro switch that the host is connected to. [EDIT END]
"So lets say you had two access switches connected with vPCs to the Nexus pair. If a device on one access switch in vlan 10 sends a packet to another device in vlan 10 on the second switch then the access switch would pick one of the etherchannel ports, send it to one of the Nexus switches. Lets say this Nexus switch is not the STP root. The Nexus switch should then send it direct to the second access switch ie. no need to go via the root bridge. "
OK, what if the destination host is connected to the root bridge for vlan 10...you know, one of the vPC switches in the pair? The access switch may send the frame on one of its port channel ports to the non-root, BUT then the frame would have to traverse the crosslink, not because the root bridge is the root but because the final destination is connected to the root and is accessible to the non-root through the crosslink. Yes?
On the other hand, in a non-vPC setup, the frame would have gone to the root brodge immediately. The observation here is that there is an element of path inefficiency with vPC.

RPVST+ at Distribution and PVST at Access Switch

Similar Messages

Maybe you are looking for