Hello Nir,
As a best practice I left STP in the Background (mstp)
Very good!
My question is this , which enhanced cisco features to STP should I configure on the Aggregator (6500-VSS) and on the Access switches ?
Well, both UplinkFast and BackboneFast are Cisco's proprietary extensions to legacy STP (and PVST/PVST+) only. RSTP and MSTP internally incorporate mechanisms identical to UplinkFast and BackboneFast. There is therefore no point in trying to activate the UplinkFast/BackboneFast if you are running MSTP. The commands would be ignored anyway.
Using the Loop Guard and UDLD (in Aggressive mode if running on copper ports) is generally a good idea and I agree with deploying them.
On the access ports I have configured portfast , bpduguard and guard root (seems a little pointless to configure the two...)
Having the edge ports configured as PortFast is a must in RSTP/MSTP to allow for fast transition to Forwarding state and to prevent them from being influenced by topological changes inside your switched network (the Proposal/Agreement mechanism that blocks all non-edge Designated ports as a part of the process). I assume here that your "access ports" as you call them are connected to end devices and not to other switches. The PortFast should correctly be used only on access ports to end devices, and never on access ports to another switches.
Using BPDU Guard along with PortFast is a best practice. However, having both Root Guard and BPDU Guard on the same port seems to me pointless as well - I would personally not use the Root Guard here.
1.should I Leave UDLD on and get rid of LoopGuard and configure Guard root instead ? since LoopGuard cannot be configured with Guard Root.
No, Loop Guard and Root Guard are totally different mechanisms, and in fact, they are mutually exclusive. A port can be either protected by Root or Loop Guard but not by both.
In addition, it is recommended to run both UDLD and Loop Guard simultaneously. They are complementary - UDLD prevents against Layer1 physical errors resulting in unidirectional links, Loop Guard prevents against possible problems in STP implementation and BPDU delivery.
2.should I configure GuardRoot on access ports if I already have BpduGuard on them ?
No, that would be useless. The Root Guard by itself moves a port into Discarding (Root Inconsistent) state if it receives a superior BPDU that would otherwise make the port the new root port. However, if at the same time, the BPDU Guard was configured on this port, an arrival of a BPDU, be it inferior or superior, would trip the BPDU Guard protection and cause the port to be immediately err-disabled. So the BPDU Guard reacts more sensitively than the Root Guard, and it is not necessary to have Root Guard on a port once you are protecting it with BPDU Guard.
3.Is there anything I need to configure on the physicall interface or is everything configured on the port-channel since STP reguards port- channel as a single interface ?
All STP-related protections (BPDU Guard, Root Guard, Loop Guard, BPDU Filter) are to be configured on the Port-channel interfaces and not on the physical ports. The notable exclusion is the UDLD - the UDLD is always configured on physical ports only.
Best regards,
Peter
