How layer 3 routing actually functions on HP?!

[UselessUser1]

Hi,

Basically what I want to achieve is the following:

Layer 2 switch in Building A connected by fiber to Building B 5400

Layer 2 switch in Building C connected by fiber to Building B 5400

I would like to basically enable layer 3 routing on the 5400 and break down broadcast domains, RSTP domains etc

... IP routing is enabled on the 5400...

Now if I do the following

Create VLANs 10,20,30 on Building A switch and 5400 and assign these as untagged on various client side ports on the Building A switch, then set them as tagged on the uplinks (Building A and the 5400)

Create VLANs 40,50,60 on Building B switch and 5400 and assign these as untagged on various client side ports on the Building A switch, then set them as tagged on the uplinks (Building B and the 5400)

With this setup because I have the default VLAN 1 as untagged on all the uplinks, I have not truly separated these devices at layer 2 have I? For example if I were to create a loop on two ports that happened to be say on the Building A switch both untagged on the default VLAN 1, this would spread across the 5400 to the switch in Building C??

Is it recommended in this case that I create another VLAN ID per building, call it "Management" and use this only on the uplinks (untagged) and give it an IP address on all devices, then I can access the switches using this?

(I apologise I am coming from a CISCO background where the interface is what sits at layer 3 rather than the VLAN which seems to be way HP does it... adding to the confusion is the fact that the 5400 is a layer 3 switch as opposed to a router) if anyone can explain this I would really appreciate it...

[paulgear]

You're asking a few different questions there. I hope i've understood your issues correctly.

You are right about the default VLAN. Essentially, you must have one layer 2 VLAN shared between both switches on a building-to-building link. You can choose whether to use a single VLAN for all building-to-building links, or one for each link. The latter is probably more ideal, but whether it is necessary or not depends on your situation. The important thing is that there are no client ports on that VLAN.

With respect to loops, turning on STP BPDU protection on all client ports is a good idea. That way if an STP BPDU is received on the port, it is automatically shut down. If your L2 switches are recent E-series, you should be able to turn this on with a simple 'spanning-tree [port list] bpdu-protection' at the CLI.

Hope that makes sense.

[UselessUser1]

Ah a reply!!

I have been watching this page a lot waiting for a response!!

I guess the first question is, what determines if it is necessary or not??

The other thing which led me to this question was STP... I have devices in the buildings which are only capable of RSTP... so I firstly will set the 5400 to RSTP compatible mode... Now the bit I don't get with RSTP is due to HP's implementation is the domain in which it functions...

So using my previous example because the untagged VLAN 1 is available right the way across the network, that is a single L2 domain, and I believe STP BPDU's are transmitted untagged so does this mean that this would be seen as a single STP domain which includes all 3 devices... am I correct that with this setup, if I define the 5400 as the STP root bridge, I am limited to a maximum of 7 devices from the 5400 to an edge? (STP diameter)??

Because I have the 5400 in the middle which is a L3 device, shouldn't I really end up with really two STP domains (But both would have a root bridge of the 5400?)

[paulgear]

I guess the first question is, what determines if it is necessary or not??

What is "it" in your question?

There's no need to change your 5400 to RSTP mode.  The RSTP switches will see the MSTP region(s) as one switch.  I have a mixed network of RSTP & MSTP on various E-series models from E5400 down, and there are no issues with the RSTP-only switches finding the correct path to the root.

I'm not sure about the issue of STP diameter; my knowledge of the protocol is not that deep.  But it sounds to me like you're assuming that STP follows the same path as L2 broadcast domains, which it doesn't.  STP packets are never forwarded (except by unmanaged devices) - they are interpreted directly by the device which receives them.  So your design in terms of STP does not constrain your L2 VLAN setup.

As long as you have only one fibre link between your building swiches and your routing switch, there isn't really anything for STP to do - the fibre links will always be forwarding if they are up.  So i would just make sure you have an appropriate L2 VLAN untagged on those ports (VLAN 1 is often used, but it doesn't matter which one it is, as long as both ends match), and set the priorities of your switches appropriately (the routing switch should have top priority (lowest number), and your others should have increasingly lower priorities as you move outwards in the network).  You might also like to set up root guard on all the non-fibre ports and BPDU protection on all the edge ports (or ports leading to unmanaged switches). That way you will ensure that your preferred (R/M)STP settings will be used at all times.

I hope that makes sense, and i hope i'm understanding your concerns correctly.