Spanning tree Cisco 2960x

[abimadaro4462]

Hello, 

I have 4 Cisco switches are connected to each other in a mesh topology with trunk links. The trunk links are allowing only specific VLANs to pass.

Spanning tree configuration as below where SW1 acting as root and SW2 acting as secondary; 

SW1

spanning-tree mode rapid-pvst
spanning-tree loopguard default
spanning-tree portfast bpduguard default
spanning-tree portfast bpdufilter default
spanning-tree extend system-id
spanning-tree vlan 1-4094 priority 25976

SW2

spanning-tree mode rapid-pvst
spanning-tree loopguard default
spanning-tree portfast bpduguard default
spanning-tree portfast bpdufilter default
spanning-tree extend system-id
spanning-tree vlan 1-4094 priority 29472

SW3 

spanning-tree mode rapid-pvst
spanning-tree extend system-id

SW4 

spanning-tree mode rapid-pvst
spanning-tree extend system-id

Please advise as i feel that this configuration can cause some troubles.

Thanks in advance

[marce1000]

 = Perhaps the question more becomes. Why did you introduce all these none-defaulting spanning tree configuration commands in to your configuration. Do you understand them. If so, why do you use them ?

 M.

[abimadaro4462]

Well as for spanning-tree portfast bpduguard default, spanning-tree portfast bpdufilter default what i know that we can save some start-up time while not allowing BPDU being sent out to the connected host.

However, I'm here asking for advice which means I'm not fully aware of spanning tree configuration. Can you advise please?

[Oleg Volkov]

Hi!

I think you do not need in bpdufilter default.

Look on show spanning tree summary and blocked ports on each switch 

[abimadaro4462]

Things are good so far no blocked ports, but i was wondering if this the right way to avoid network loops as they are connected to each other with 6 links in mesh

[kapslock · Accepted solution]

Config on SW1 and SW2 looks fine, but you should include the same config on SW3 and SW4

spanning-tree loopguard default
spanning-tree portfast bpduguard default
spanning-tree portfast bpdufilter default

Also using bpduguard and bpdufilter as defaults, you have to make sure to define all edge ports as access interfaces with "switchport mode access" and to use bpduguard and filter you have to type "spanning-tree portfast" on edge ports.

I would also include in global config "spanning-tree portfast default" which enables all ports configured as access mode, to run spanning-tree portfast as default.

The purpose of Port Fast is to minimize the time interfaces must wait for spanning-tree to converge, it is effective only when used on interfaces connected to end stations. If you enable Port Fast on an interface connecting to another switch, you risk creating a spanning-tree loop.

[abimadaro4462]

Thanks for your explanation,
Do you think it's good idea to configure the priority of other switches as well?

[kapslock]

Personally I include a priority of 16,384 ‬on all switches except the distribution layer, just in case somebody attaches a switch with lower mac add and tries to take root role. I would then setup a lower priority on my distribution switches to take the root role. You want the root bridge to be at a central place in the network, to optimize the data path.