vPC spanning tree issue

[sg.lee]

We are running a pair of N7K in NX-OS mode. These two switches are connected in a vPC peer set up.

And N3K#1 uplinked to both N7K switches and it's spanning tree root for all VLANs. (it means non-vPC member port)

In this scenario the N3K switch is root bridge and RSTP alternate port will be set on vPC peer-link.

But I found out the rule on vPC will never be blocked on both vPC peer-link.

I wonder how it work with this scenario?  No STP blocked port any switch?

[Andrea Testino]

Hi,

This scenario is fairly common and you should not have anything to worry about. Nexus in a vPC domain use vPC's Data-Plane Loop Avoidance by default instead of relying on STP/control-plane.

I'd read over vPC Best Practices Guide, Page 8 goes over the Loop Avoidance rule that covers the scenario you're mentioning where all STP ports are Forwarding, link below:

https://www.cisco.com/c/dam/en/us/td/docs/switches/datacenter/sw/design/vpc_design/vpc_best_practices_design_guide.pdf

Let me know if something isn't clear. Happy to help.

[sg.lee]

I checked loop avoidance behavior with vPC member ports. But in my case the N3K is not configured port-channel and both N9K switches are not configured vPC member. Just working as legacy RSTP.

In my opinion, N3K is root bridge and both N9K switches peer-link can't be root port, therefore the peer-link will be blocked.

But vPC will never be blocked on both vPC peer-link and it's working as root port.

[Remi Astruc]

Hello,

The peer-switch statement under VPC domain configuration will make the N7Ks being seen as a single STP device. That must be configured on both N7K and with the same STP priority on both.

That being said, I don't see any benefit in your STP design instead of aggregating the N3K uplinks into a VPC, which would remove STP questions and allow all uplinks usage. Alternatively, you may think about moving STP Root to N7K if your design permits it.

Remi Astruc