RSTP issue on ProCurve 2510G-48 and 2510B-24

[Metze]

Hi,

I have a root-bridge (2510B-24) and a non-root-bridge (2510G-48). Before I installed the new non-root-bridge, there was also asecond 2510B-24 installed as a non-root-bridge.

The config looks like this:

I have several 19" Racks each has a non rstp switch installed. Each switch has a uplink to the root-bridge (separated by VLANs) - so far, so good! Now I want to plug the second uplink from each 19"-Rack-Switch in the non-root-bridge an this bridge is blocking all plugged ports. The logging tells my that these ports where disabled due a STP issue (port # is Blocked by STP). sh spanning-tree tells me the correct designated bridge (MAC address of the root-bridge is shown), but the state is set to "Blocking", exept one port is set to "Forwarding"!!

This port is similar to the other ports (on each port is a no stp switch attached). Does the non-root-bridge discover a loop or something?

What can I do? (and sorry for my bad english writing ;-) )

[Richard Brodie_1]

You have something like:

      Root

    /     |    \

   A    B    C

    \     |     /

    Non-root    

And only one of the uplinks from the non-root bridge is active? Unfortunately that is expected behaviour.

There are various things you could do:

1. Flip the root to the 2510G, so its links are active (especially if they are Gbit ones).

2. You could bpdu-filter on the uplink ports on the Non-root to force them to be forwarding. If you're sure there is no traffic that can flow round the loop!

3. Change to MSTP - a lot of configuration needed.

[Metze]

Hi Richard! Thanks for your reply.

I attached a picture of my config.

Only port 1 and port 46 are forwarding. All other ports are blocking.

Just for info: In this sketch you see two 2510G-48. That's because I'm replacing the old 10/100Mbits devices to the new 1Gbits ones. For now I replaced the old non-root-bridge (swx_2). To change the root-bridge I wanted to set the backp router to active (tfkiel_kiwi_fw_2(B)) so the traffic goes through the new non-root-bridge and i could change the old root-bridge (swx_1).

[Metze]

Weird behaviour!!

I just rebooted the non-root-bridge an it says now that the cst root port is port 1? Before it was port 48!

Here what it looks like when i type sh spanning-tree:

STP Enabled   : Yes
  Force Version : RSTP-operation
  IST Mapped VLANs : 1-4094
  Switch MAC Address : ec9a74-ae7440
  Switch Priority    : 4096 
  Max Age  : 20
  Max Hops : 20
  Forward Delay : 15

  Topology Change Count  : 3           
  Time Since Last Change : 26 mins     

  CST Root MAC Address : c09134-519d40
  CST Root Priority    : 0           
  CST Root Path Cost   : 20000       
  CST Root Port        : 1                  

  IST Regional Root MAC Address : ec9a74-ae7440
  IST Regional Root Priority    : 4096        
  IST Regional Root Path Cost   : 0           
  IST Remaining Hops            : 20          

  Root Guard Ports : 
  TCN Guard Ports  : 
  Protected Ports :                                                          
  Filtered Ports : 5                                                         

                  |           Prio             | Designated    Hello         
  Port  Type      | Cost      rity  State      | Bridge        Time  PtP Edge
  ----- --------- + --------- ----- ---------- + ------------- ----- --- ----
  1     100/1000T | 20000     128   Forwarding | c09134-519d40 2     Yes No  
  2     100/1000T | Auto      128   Disabled   |
  3     100/1000T | 20000     128   Blocking   | c09134-519d40 2     Yes No  
  4     100/1000T | Auto      128   Disabled   |
  5     100/1000T | 20000     128   Forwarding | ec9a74-ae7440 2     Yes Yes 
  6     100/1000T | Auto      128   Disabled   |
  7     100/1000T | 20000     128   Forwarding | ec9a74-ae7440 2     Yes Yes 
  8     100/1000T | Auto      128   Disabled   |
  9     100/1000T | 20000     128   Blocking   | c09134-519d40 2     Yes No  
  10    100/1000T | Auto      128   Disabled   |
  11    100/1000T | 20000     128   Blocking   | c09134-519d40 2     Yes No  
  12    100/1000T | Auto      128   Disabled   |
  13    100/1000T | 20000     128   Blocking   | c09134-519d40 2     Yes No  
  14    100/1000T | Auto      128   Disabled   |
  15    100/1000T | 20000     128   Blocking   | c09134-519d40 2     Yes No  
  16    100/1000T | Auto      128   Disabled   |
  17    100/1000T | Auto      128   Disabled   |
  18    100/1000T | Auto      128   Disabled   |
  19    100/1000T | 200000    128   Blocking   | c09134-519d40 2     Yes No  
  20    100/1000T | Auto      128   Disabled   |
  21    100/1000T | 20000     128   Forwarding | ec9a74-ae7440 2     Yes Yes 
  22    100/1000T | Auto      128   Disabled   |
  23    100/1000T | 20000     128   Forwarding | ec9a74-ae7440 2     Yes Yes 
  24    100/1000T | Auto      128   Disabled   |
  25    100/1000T | 20000     128   Forwarding | ec9a74-ae7440 2     Yes Yes 
  26    100/1000T | Auto      128   Disabled   |
  27    100/1000T | Auto      128   Disabled   |
  28    100/1000T | Auto      128   Disabled   |
  29    100/1000T | Auto      128   Disabled   |
  30    100/1000T | Auto      128   Disabled   |
  31    100/1000T | Auto      128   Disabled   |
  32    100/1000T | Auto      128   Disabled   |
  33    100/1000T | Auto      128   Disabled   |
  34    100/1000T | Auto      128   Disabled   |
  35    100/1000T | Auto      128   Disabled   |
  36    100/1000T | Auto      128   Disabled   |
  37    100/1000T | Auto      128   Disabled   |
  38    100/1000T | Auto      128   Disabled   |
  39    100/1000T | Auto      128   Disabled   |
  40    100/1000T | Auto      128   Disabled   |
  41    100/1000T | Auto      128   Disabled   |
  42    100/1000T | Auto      128   Disabled   |
  43    100/1000T | Auto      128   Disabled   |
  44    100/1000T | Auto      128   Disabled   |
  45    100/1000T | 200000    128   Blocking   | c09134-519d40 2     Yes No  
  46    100/1000T | 20000     128   Forwarding | ec9a74-ae7440 2     Yes Yes 
  47    100/1000T | 20000     128   Forwarding | ec9a74-ae7440 2     Yes Yes 
  48    100/1000T | 20000     128   Blocking   | c09134-519d40 2     Yes No  

As you can see port 5, 7, 21, 23 and port 25 are using the non-root-bridge as designated bridge. Why?

I dont't get it!

Can I manually set the cst root port? It is definitely not port 1!

[Richard Brodie_1]

To be honest, it made more sense before the reboot but less so now.

5, 7, 21, 23 and port 25 all seem to be edge ports; can't see the root bridge for some reason.

5 is filtered, so that makes sense - don't know about the others.

As for the CST root port: now you have a switch with gigabit on all its ports, almost all the links to the root look equally good. When it's a tie, lowest wins. You could lower the path cost on the interface, if you have a preferred port.

[Metze]

Here the config from my non-root-bridge (maybe you can see anything odd):

Startup configuration:

; J9280A Configuration Editor; Created on release #Y.11.12

hostname "swx_2-TFKiel" 
max-vlans 64 
time timezone 1 
no cdp run 
web-management ssl 
interface 1 
   name "vlan-1000-ohbh" 
exit
interface 2 
   name "vlan-1000-ohbh" 
exit
interface 3 
   name "vlan-1001-dmz" 
exit
interface 4 
   name "vlan-1001-dmz" 
exit
interface 5 
   name "vlan-1002-transfair" 
exit
interface 6 
   name "vlan-1002-transfair" 
exit
interface 7 
   name "vlan-1003-ibk" 
exit
interface 8 
   name "vlan-1003-ibk" 
exit
interface 9 
   name "vlan-1004-wfbdra" 
exit
interface 10 
   name "vlan-1004-wfbdra" 
exit
interface 11 
   name "vlan-1005-kisk" 
exit
interface 12 
   name "vlan-1005-kisk" 
exit
interface 13 
   name "vlan-1006-marli" 
exit
interface 14 
   name "vlan-1006-marli" 
exit
interface 15 
   name "vlan-1007-tfkiel_voice" 
exit
interface 16 
   name "vlan-1007-tfkiel_voice" 
exit
interface 19 
   name "vlan-1011-innovaphone" 
exit
interface 20 
   name "vlan-1011-innovaphone" 
exit
interface 21 
   name "vlan-1010-integra" 
exit
interface 22 
   name "vlan-1010-integra" 
exit
interface 23 
   name "vlan-1012-altenhilfe" 
exit
interface 24 
   name "vlan-1012-altenhilfe" 
exit
interface 25 
   name "vlan-1013-wub" 
exit
interface 26 
   name "vlan-1013-wub" 
exit
interface 43 
   name "vlan-2000-ext_dmz" 
exit
interface 44 
   name "vlan-2000-ext_dmz" 
exit
interface 45 
   name "vlan-2000-ext_dmz" 
exit
interface 46 
   name "vlan-2000-uplink_juniper_backup_ext_dmz" 
exit
interface 47 
   name "vlan-all-uplink_juniper_backup" 
exit
interface 48 
   name "vlan-all-ha_link_root_bridge" 
exit
sntp server 192.168.255.10 
timesync sntp 
snmp-server community "public" Unrestricted 
vlan 1 
   name "DEFAULT_VLAN" 
   untagged 17-18,27-42 
   ip address dhcp-bootp 
   no untagged 1-16,19-26,43-48 
   exit 
vlan 1000 
   name "ohbh_trust" 
   untagged 1-2 
   tagged 47-48 
   exit 
vlan 1001 
   name "dmz" 
   untagged 3-4 
   tagged 47-48 
   exit 
vlan 1002 
   name "transfair" 
   untagged 5-6 
   ip address 192.168.8.201 255.255.255.0 
   tagged 47-48 
   exit 
vlan 1003 
   name "ibk" 
   untagged 7-8 
   tagged 47-48 
   exit 
vlan 1004 
   name "wfbdra" 
   untagged 9-10 
   tagged 47-48 
   exit 
vlan 1005 
   name "kisk" 
   untagged 11-12 
   tagged 47-48 
   exit 
vlan 1006 
   name "marli" 
   untagged 13-14 
   tagged 47-48 
   exit 
vlan 1007 
   name "tfkiel_voice" 
   untagged 15-16 
   tagged 47-48 
   exit 
vlan 1010 
   name "integra" 
   untagged 21-22 
   tagged 47-48 
   exit 
vlan 1011 
   name "innovaphone" 
   untagged 19-20 
   tagged 47-48 
   exit 
vlan 1012 
   name "altenhilfe" 
   untagged 23-24 
   tagged 47-48 
   exit 
vlan 1013 
   name "wub" 
   untagged 25-26 
   tagged 47-48 
   exit 
vlan 2000 
   name "ext_dmz" 
   untagged 43-46 
   tagged 47-48 
   exit 
no lldp run 
no stack 
spanning-tree
spanning-tree 5 bpdu-filter
spanning-tree bpdu-protection-timeout 300 priority 1 force-version RSTP-operation
ip ssh

and from my root-bridge:

Startup configuration:

; J9019B Configuration Editor; Created on release #Q.11.26

hostname "swx_1-TFKiel" 
max-vlans 64 
time timezone 1 
no cdp run 
web-management ssl 
no telnet-server 
interface 25 
   name "SSG520M_e0/1" 
exit
interface 26 
   name "uplink_swx_1" 
exit
sntp server 192.168.255.10 
vlan 1 
   name "DEFAULT_VLAN" 
   untagged 23,25 
   no ip address 
   no untagged 1-22,24,26 
   exit 
vlan 1000 
   name "OHBH_Trust" 
   untagged 1 
   tagged 25-26 
   exit 
vlan 1001 
   name "DMZ" 
   untagged 3 
   tagged 25-26 
   exit 
vlan 1002 
   name "TRANSFAIR" 
   untagged 5-6 
   ip address 192.168.8.200 255.255.255.0 
   tagged 25-26 
   exit 
vlan 1003 
   name "IBK" 
   untagged 7-8 
   tagged 25-26 
   exit 
vlan 1004 
   name "WfBDra" 
   untagged 9-10 
   tagged 25-26 
   exit 
vlan 1005 
   name "KISK" 
   untagged 11-12 
   tagged 25-26 
   exit 
vlan 1006 
   name "MARLI" 
   untagged 13-14 
   tagged 25-26 
   exit 
vlan 1007 
   name "TFKiel_Voice" 
   untagged 15-16 
   tagged 25-26 
   exit 
vlan 2000 
   name "ext_dmz" 
   untagged 20,24 
   tagged 25-26 
   exit 
vlan 1008 
   name "offline" 
   untagged 17 
   tagged 25-26 
   exit 
vlan 1009 
   name "a1" 
   untagged 18 
   tagged 25-26 
   exit 
vlan 1010 
   name "integra" 
   untagged 21 
   tagged 25-26 
   exit 
vlan 1011 
   name "innovaphone" 
   untagged 2,19 
   tagged 25-26 
   exit 
vlan 1012 
   name "altenhilfe" 
   untagged 22 
   tagged 25-26 
   exit 
vlan 1013 
   name "wub" 
   untagged 4 
   tagged 25-26 
   exit 
no lldp run 
no stack 
management-vlan 1002 
spanning-tree
spanning-tree 25 admin-edge-port
spanning-tree priority 0 force-version RSTP-operation
ip ssh

[Richard Brodie_1]

I can't see anything unusual in the configs. The firmware is a few years old, if the versions you are currently running are the same as the ones in the configuration files.

If you can schedule an update, I would try that.

[Metze]

The non-root-bridge is now up to date (Software revision Y.11.35). I'll update the root-bridge later.