Common STP domain between ISP and customer

[Alexander Istomin]

Hello everyone!

What is the best practice to configure STP in the scenario as shown in the picture below?

How to protect ISP network from misconfiguration on the client side?

1. Root on ISP side?

2. Root guard on access ports to client?

3. Something else?

[paul driver]

Hello

so you only concern here is what link from the access switch you would like to be the primary/secondary link 

You  already have the switch attached to you network and stp primary and secondary are defined?

The most simplistic way is to use spanning-tree port- priority xx to make the preferred link - this is very useful as it is only port/interface specific and doesn’t effect the entire stp calculation path like a change the port cost would do.

[paul driver]

Hello

Looking at your diagram, it looks like although you will be trunking into the isp , It will probably be into a router not a switch, If this is correct then those switches interconnecting towards the ISP you would define them as your primary/secondary stp roots,

On the access layer switches these would have stp bridge priority much higher than the primary/secondary root switches and their switchports would be in a administrative mode of access with port fast/bpduguard enabled.

I would say rootguard wouldn't really be applicable It would only feasible if you are interconnecting different dtp domains or you have the potential for ports you dont want to become root ports.

[Alexander Istomin]

Hello, Paul!

We are ISP. The client wants to connect his switch to our network with 2 access links for redundancy as I've shown on the picture. So no trunks to ISP, no routers.

[shaps]

I used to work for a small MSP and we had a lot of request to hand off via a switch, root guard is advisable for sure, you never know what the customer would do in the future.