Spanning-Tree major problems

[Frazer Johnson Jr]

So about a month ago I did a network upgrade for a client 2x 1841 to 2x 1921, 2x 4948 to 2x 4948E, and 2x 2950 to 2x 3650. I basically just copied and pasted the config over with very little modifications. On the night of the migration a loop occurred and brought down everything, luckily we were in our change window. The loop happened because between the 2x 4948e have a fiber trunk between them and uplinks to their 2x Checkpoint firewalls. Once I connected the link to firewall 2 to the last 4948e the loop occurred and the network didn't recover until I disconnected. Even though 802.1D was configured it didn't work. That night I ended up not deploying one of the 4948e. Now the customer wants to migrate from legacy PVST to PVRST when we go to address the issue.

My concern is that this migration is going to make matter worst, because according to him there are 8 other switches in the infrastructure which I haven't seen the configurations for. Also, I'm scratching my head as to how the network isn't looping with the 1x legacy 4948 even though the the 4948E has the same config with 802.1D STP configure. and why is it that as soon as I connected there firewall the loop happens. Any advice would be useful.

[Anthony Brandelli]

Having issues visualizing this topology in my head... 

Two things here. While I would recommend RVPST+ be used in any network over PVST+ I would agree the merits aren't there unless we fix the current issue. 

On the switches you're going to have to have a look at their view of the topology, then cross that to what it should be. Who should be root, what ports should be blocking, etc. sh spanning-tree xxxx. 

Make sure to look over the spanning tree config on all switches, or post the relevant parts here for others to look at. I've seen people do silly things like disable STP for one VLAN that could cause this.