Dear Community,
I had a recent issue where BA had blocked on a few VLANs on a PC between our core 7ks and our 9k's which are currently acting as agg switches. The blocking only happened for about a second but that was enough to cause some issues. When researching I found the following explanation for BA
"BA is a feature that provides additional protection in environments running the Spanning Tree Protocol (STP). BA works by forcing a bridge to send BPDUs on a “network” port, even if that port is not a designated port. Consequently, a bridge expects to receive BPDUs on a “network” port, even if it is the designated bridge.
If a Bridge Assurance-enabled network port does not receive any BPDU for a configurable period of time, the interface moves into the blocking state. After the network port receives a BPDU again, the port begins its normal spanning tree transitions.
Bridge Assurance is similar in many ways to the Loop Guard feature, which has been available for many years on other platforms. The main weakness of Loop Guard is that it needs to receive at least one BPDU to detect a peer. Bridge Assurance does not suffer from this issue as the existence of the peer is identified by configuration.
Bridge Assurance is enabled by default on all ports of type ‘Network’. Bridge Assurance requires both ends to be enabled for the feature – the port will not function if one end only supports it. "
I had a few questions regarding this:
1) "BA is a feature that provides additional protection in environments running the Spanning Tree Protocol (STP). BA works by forcing a bridge to send BPDUs on a “network” port, even if that port is not a designated port. Consequently, a bridge expects to receive BPDUs on a “network” port, even if it is the designated bridge." Does this mean that BA will force a "network type" port to send BPDU on the port even if RSTP fails to send a BPDU? Is BA designed to keep a VLAN in forwarding when STP "Fails"?
2) "If a Bridge Assurance-enabled network port does not receive any BPDU for a configurable period of time, the interface moves into the blocking state. After the network port receives a BPDU again, the port begins its normal spanning tree transitions." Is there a difference between a BA generated BPDU and an STP generated BPDU? If youre running RPVST+ then BPDU's shoud be flowing between non-edge interswitch links yes? So if you have a BA issue does this mean that both BA and STP failed to send a BPDU for that vlan?
3) "Bridge Assurance is enabled by default on all ports of type ‘Network’. Bridge Assurance requires both ends to be enabled for the feature – the port will not function if one end only supports it. " Can the BA enabled port discern between a BA generated BPDU and an RPVST+ generated BPDU? I ask because even if one end of the link isnt capable of BA, RPVST+ should still be sending BPDU's every 2 seconds, will BA still consider this as positive feedback from its peer?
Below is the error messages I was receiving:
2020 May 17 06:00:33 9396L3SW003 %STP-2-BRIDGE_ASSURANCE_BLOCK: Bridge Assurance blocking port port-channel200 VLAN2292.
2020 May 17 06:00:33 9396L3SW003 %STP-2-BRIDGE_ASSURANCE_UNBLOCK: Bridge Assurance unblocking
port port-channel200 VLAN2292.
2020 May 17 06:00:34 9396L3SW003 %STP-2-BRIDGE_ASSURANCE_BLOCK: Bridge Assurance blocking port port-channel200 VLAN0029.
2020 May 17 06:00:34 9396L3SW003 %STP-2-BRIDGE_ASSURANCE_UNBLOCK: Bridge Assurance unblocking
port port-channel200 VLAN0029.
2020 May 17 06:00:34 9396L3SW003 %STP-2-BRIDGE_ASSURANCE_BLOCK: Bridge Assurance blocking port port-channel200 VLAN2202.
2020 May 17 06:00:34 9396L3SW003 %STP-2-BRIDGE_ASSURANCE_UNBLOCK: Bridge Assurance unblocking
port port-channel200 VLAN2202.
2020 May 17 06:00:34 9396L3SW003 %STP-2-BRIDGE_ASSURANCE_BLOCK: Bridge Assurance blocking port port-channel200 VLAN2203.
2020 May 17 06:00:34 9396L3SW003 %STP-2-BRIDGE_ASSURANCE_UNBLOCK: Bridge Assurance unblocking
port port-channel200 VLAN2203.
The Po200 interface on the 7k is NOT explicitly configured as "spanning-tree port type network" but the po200 interface on the 9k it is uplinked to is. Does this mean that BA is NOT enabled on the Po200 interface on the 7k? Any way to verify this? Unfortunately we are having logging issues on our 7k (which we just found out) so the logs on the 7k couldnt tell us anything about what happened at the time. The 9k logged it though as you can see.
Thanks so much for any feedback you can provide!
