LAN to LAN peering and spanning-tree

[dazni]

Hello,

We would like to create a "lan to lan peering" between our infrastrucre (Site A) and our partner's infrastructure (Site B).
The link between us will be an optical fiber connection between both switches (SW-A and SW-B) and will carry a vlan ( ID 99) to the firewalls, where an Layer3 interface will be created to handle the traffic between the two sites.

We want to prevent any spanning tree issue when connection both LAN to each other (spanning tree topology recalculation, root bridge changing...). 

What would be the recommandations for this kind of architecture please ?

Disabling spanning tree on the Gi1/1 ports with bpdu filter ?
Using BPDU Guard/Root Guard ? (but with this feature I suppose each interface will be in an error-disabled state as the bpdu frames will be detected on both sides )

Thank you.
Regards,
Dazni

[balaji.bandi]

if this is your diagram i do not see any Loops here. as per spanning-tree priority concern, set lower the value of default (32768) to become a root bridge.

is this Access port or going to be trunk port ?

STP increments  pr decerement priority by 4096

[dazni]

The partner's switch has a lower priority than us and both switches are already in production and used for other traffics.
We prefer to avoid changing the STP priority.

The port is going to be a trunk port.

Is there a way to connect the two switches and tell them not to interfere with each other's spanning tree priority and root election ?
As you said there is no loop because we will have only one link between => can we disable the spanning tree on these ports ?

Thanks !

[balaji.bandi]

You can only mentioned for that VLAN where you looking to be root bridge your side or partner side with low priorty.

if the link already established or this new link you only allowing vlan 99 ?

STP always better on Layer 2 Links, disabling that will have other side impacts.

[dazni]

The link isn't yet established. Actually both sites are in the same datacenter and I'd like to be sure of what will happen before I go there to plug the optical fiber.
Only the VLAN 99 will be allowed but another VLAN will be allowed later for a direct transfert link between two NAS, each NAS on both side will have an interface on the same subnet (because the firewalls are no sized to handle as much trafic).

The priority on the partner switch is set to 4096 in the SPT configuration (globaly) and to 32768 on our switch so I guess that the partner switch will try to become the root bridge of our LAN when we will connect the link and that's what I want to avoid. 

[balaji.bandi]

yes as per descitpion partnet wins and act as root bridge for VLAN

your approach is correct , start with vlan allow in the list of vlan allowed 99, gradually add where required, that way you have total control over vlan list.

[dazni]

So the partner switch will become the root bridge only for the VLAN I'll add to the trunk and all the other VLAN already created on the switches and the spanning tree recalculation will not be impacted when I'll connect the fiber between them ?

switchport mode trunk and switchport trunk allowed vlan 99 will be the only commands we need for the port configuration, without other features ?

Thank you for your help.

[balaji.bandi]

So the partner switch will become the root bridge only for the VLAN I'll add to the trunk and all the other VLAN already created on the switches and the spanning tree recalculation will not be impacted when I'll connect the fiber between them ?

they only span what VLAN allowed in the Trunk and try to elect Root bridge in Layer 2 network, in your case 99, by any chance you use vlan 1 ?

switchport mode trunk and switchport trunk allowed vlan 99 will be the only commands we need for the port configuration, without other features ?

yes, make it simple i use simple config as mentioned if no other link to make a network loop.

[mlund · Accepted solution]

Hi

If you are shure that this link will be the only one, then you can configure "spanning-tree bpdu-filter enable" on the Gi1/1 port. This way you are blocking the neighbors bpdu, and so you will have your own spanning-tree topology and also your own root bridge. This is in my opinion a better way than disabling spanning-tree.

/Mikael

[dazni]

Hi Mikael,

Yes I'm sure that this link will be the only one. 

BPDU filter is what I was thinking about when I talk about disabling spanning tree on the interface (and I think bpdu filter is the only way to do it, no ?) 
Due to my limited knowledge in networks, I wasn't sure that it was something "clean" to do, so I prefered to ask you guys and get some advice or different ways to configure it.
Thank you.

[dazni]

VLAN 1 is used on our infrastructure yes, but not on the partner side.
Thank you.

[MHM Cisco World]

Follow 

[marce1000]

 - Any special reason for a layer 2 (VLAN) link. If you start with a routed solution from the firewalls as peers , you start with  higher security and or can additionally configure your firewall to give access to needed objects/services  (app-firewalling) only.

 M.

[dazni]

We are connected to them through an IPsec tunnel between the two firewalls but we will have an heavy data transfer and the firewalls will be overloaded if we use the IPsec tunnel for this trafic. 
Behind the switches, there will be two NAS, one on each side and the data transfer will go directly from NAS A to NAS B.

[MHM Cisco World]

For give my little knowledge but 

you looking for west-to-east traffic for two different DC.

the question here why you not config FW as transport mode i.e. L2 FW.

The vlan will re write and I think with this way stp will not be issue anymore.