MST - Multiple Spanning Tree - Don't change the mappings!

MST allows you to create spanning-tree instances and map VLANs into them.

Combined with VTP version 3 means you can advertise the MST mappings automatically, as shown here.

MST has the concept of regions.

Whether a switch is a member of a particular region depends on three things:

• The configured MST region name.


• The configured MST revision number.


• The VLAN to MSTI mappings.

The entire VLAN to MSTI mapping isn't advertised in each BPDU but a checksum of the mapping table is.

So why do I care?

Because if you change the mappings, you change the region.

If you change the region that the root bridge belongs to, it's a topology change and you trigger a total STP re-convergence.


So if you're in a live network and you tweak the VLAN-to-MSTI mappings then you'll cause a complete outage. If it's running VTPv3 then the outage will be longer as the change ripples through the network and switches "re-join" the region.

The solution

The solution in this case is fairly easy, set up all your mappings on day 1 and stick to them!

If you've two switches then you're best off finding a suitable way to distribute the VLANs, e.g.

MSTI 1 - VLANS 1 to 1999 - Root bridge SW1
MSTI 2 - VLANS 2000 to 4096 - Root bridge SW2

Then make sure you set up HSRP/VRRP in future to match where the MSTI is rooted for each particular VLAN.

Read more...

Cisco Gotchas - Max VLANs and STP Instances

Cisco switches have separate limitations on:

• The number of VLANs that can exist in the database.


• The number of Spanning-Tree Instances that can run.

Cisco kit tends to use per-VLAN spanning-tree in which case the two values will be the same.


To understand the problem and solution requires knowledge of the different types of spanning-tree available, this subject is huge but very briefly the types are:

1. Standard 802.1D Spanning-Tree


2. PVST, Per-VLAN Spanning-Tree (ISL trunking only)


3. PVST+, Per-VLAN Spanning-Tree plus (compatible with 802.1q trunks)


4. Rapid PVST - RSTP version of PVST+


5. MST - Multiple Spanning Tree

The limitations are as follows on switches running PVST, PVST+ or Rapid-PVST:

• 2950 SI: Maximum 64 STP instances, Maximum 128 VLANs.


• 2950 EI: Maximum 64 STP instances, Maximum 250 VLANS.


• 3550, 3560, 3750: Maximum 128 STP instances, Maximum 1005 VLANs.


• 6500: Based on logical ports. Article here.

If you exceed the number of VLANs then you'll get an error like this:

SPANTREE_VLAN_SW-2-MAX_INSTANCE: Platform limit of 64 STP instances exceeded. No instance created for VLANxxx

Solutions

There are a couple of workarounds:

• Delete some VLANs!


• Manually prune VLANs off the trunk links and set the switch to VTP mode transparent so it doesn't know about the extra VLANs.


• Use MST instead of PVST.

MST is my preferred option. Most networks will only require 2 or 4 Spanning-Tree topologies anyway so it is wasteful to have STP running in every VLAN.




Read more...

Cisco Gotchas - 16 Unique Standby Groups

HSRP is configured in standby groups, each one having an identifier value in the switch configuration.

The acceptable range of values is 0-255 and you can create as many as you want. Cisco don't recommended using more than 500 on a 6500 series or 64 on the 3550.

There are limitations on the number of unique ID values you can assign however.


Each instance is configured using the standby command:

interface FastEthernet 0/10
ip address 10.0.0.3 255.255.255.0
standby 10 ip 10.0.0.1
standby 10 preempt

The gotcha is that you can create as many groups as you want, but you can only use 16 different values for the ID.

This is hardware/software specific, but it's not clear what hardware it's specific to. The Cisco FAQ says it only affects PFC2, but their bug tracker doesn't mention the PFC and has a "fixed in" entry indicating that it's not an issue with newer software.

So feel free to create as many unique IDs as you like, but when adding the 17th check the logs to make sure it's actually working!

Or you could use VSS and get rid of HSRP entirely.

The Cisco FAQ for this issue on the 6500 is here.
There is a bug open on the Cisco tracker, CSCdx32496.


Read more...