Notes: Spanning Tree Protocol Problems and Related Design Considerations

I'm troubleshooting an STP issue at work, so I decided to continue my "Notes" collection with the documentation I'm reading.

This post discusses some of the common reasons that STP can fail and the information for which to look to identify the source of the problem. The post also shows the kind of design that minimizes STP related issues and is easy to troubleshoot.

Spanning Tree Protocol Failure

• The primary function of STP is to cut loops created by redundant links in a Layer 2 network.
• Switches exchange BPDUs to elect which port should forward or block traffic.
• Troubleshooting can be very difficult, depending on the design.
• A loop occurs when a port should block, but instead forwards traffic.

STP Convergence

Next, different situations that can use the STA (STP algorithm) to fail are listed. Most of these failures relate to a massive loss of BPDUs, which causes blocked ports to transition to forwarding mode.

Duplex Mismatch

If the duplex mode is manually set to Full on one side and left to autonegotiate on the other side, the link ends up in half-duplex. The port with full-duplex no longer negotiates. The full-duplex/half-duplex mismatch can easily lead to a switching loop. The full-duplex does not perform carrier sense before sending frames, so it can transmit traffic even if the half-duplex is already using the link. This situation is a problem for half-duplex; the switch detects a collision and runs the backoff algorithm before the bridge attempts another transmission of the frame. If there is enough traffic from full-duplex, every packet from half-duplex undergoes deferment or collision and eventually gets dropped. From STP's perspective, full-duplex does not receive BPDUs from half-duplex any more, so it starts unblocking ports to find an alternate path to the root.

Unidirectional Link

• Common cause of a switching loop.
• Possible causes on fiber links: a failure that goes without detection or a problem with a transceiver.
• Anything that can lead to a link staying up and providing a one-way communication is very dangerous with regard to STP.

SW-A DSG ----------+ BLK SW-B
      -- BPDUs lost -->
     <-- BPDUs sent --

• The link drops traffic from SW-A to SW-B while transmitting traffic from SW-B to SW-A.
• Assume that SW-B was blocking before the link became unidirectional.
• Since all BPDUs that come from SW-A are lost, SW-B eventually transitions its port to forwarding state creating a loop.
• UDLD can detect improper cabling or unidirectional links at Layer 2 and automatically break resulting loops by distabling some ports.

Packet Corruption

• If a link has a high rate of physical errors, a certain number of consecutive BPDUs can be lost, which can lead a blocking port to transition to forwarding state.
• Not common because STP default parameters are very conservative.
• The blocking port needs to miss BPDUs for 50 seconds before transitioning to forwarding.
• The successful transmission of a single BPDU breaks the loop.
• Typically occurs with the careless adjustment of STP parameters, for example changing the max-age.

Resource Errors

• STP is implemented in software, even on high-end platforms that perform most switching functions in hardware with specialized ASICs.
• If the CPU is overutilized, resources can be inadequate for the transmission of BPDUs.
• The STA is generally not processor-intensive and has priority over other processes.

PortFast Configuration Error

• PortFast is typically enabled on interfaces that conenct to a host.
• When the link comes up, the switch skips the first states of the STA and directly transitions to the forwarding state.
• If enabled between two switches with redundant links, a loop is created.
• The loop stops as soon as either switch receives a BPDU that puts one of the ports in blocking mode.
• But if the traffic is very intensive, the switch can have trouble succesfully sending any BDPUs.
• The problem can delay the convergence considerably or bring down the network in extreme cases.

Awkward STP Parameter Tuning and Diameter Issues

• An aggressive value for the MaxAge parameter and the ForwarDelay can lead to a very unstable STP
• topology.
• The conservative default values for the STP timers impose a maximum network diameter of seven.
• The maximum network diameter restricts how far away from each other the switches in a network can be.
• In this case, two distinct switches cannot be more than seven hops away from each other.
• Part of the restriction comes from the Age field in the BPDU.
• When a BPDU propagates from the root switch toward the leaves of the tree, the Age field increments at each switch.
• Eventually, the BPDU is discarded when the Age field goes beyond a maximum value.
• Chaning STP timers requires careful planning.
• It's dangerous to try to achieve faster convergence in this way.
• Modifying an STP timer has an impact on the diameter of the network and the stability of the STP.

Software Errors

• As one of the first features implemented in Cisco products, STP is generally very stable.
• Only interaction with newer features, like EtherChannel, has caused STP to fail in some very specific cases in the past.
• A number of different factors can cause a software bug and can have a number of different effects.
• No way to adequately describe the issues that a bug can introduce.
• Dangerous: if BPDUs are ignored or a blocking port transitions to forwarding.

Design STP for Trouble Avoidance

Know Where the Root Is

• Do not leave STP to decide which switch is root.
• Root placement depends on the design of the network.
• Generally, choose a powerful switch in the middle of the network.
• For each VLAN, hardcode the primary and secondary root switches with a reduction of the STP priority parameter.

Know Where Redundancy Is

• Plan the organization of redundant links.
• Forget about the plug-and-play feature of STP.
• Tune the STP cost parameter to decide which ports block.
• Tuning is usually not necessary if a hierarchical design exists and the root switch is in a good location.
• For each VLAN, know which ports should be blocking in a stable network.
• Have a network diagram that clearly shows each physical loop and which ports should be blocked to break them.

Minimize the Number of Blocked Ports

• The only critical action that STP takes is the blocking of ports.
• A single blocking port that mistakenly transitions to forwarding can melt down a large part of the network.
• To limit the risk, reduce the number of blocked ports as much as possible.

Prune Unused VLANs

• No need for more than two redundant links between two nodes in a switched network.
• Distribution switches are typically dual-attached to two core switches.
• However, each distribution switch might connect hosts in different VLANs. They would then receive unnecessary broadcast and multicast traffic for the other VLAN, and also block one port for that VLAN.
• Prune any VLAN that you do not need off your trunks.

Use Layer 3 Switching

• Layer 3 switching means routing almost at the speed of switching.
• A router performs to main functions:

1. A router builds a forwarding table, and exchanges information with peers using a routing protocol.
2. A router receives packets and forwards them to the correct interface basd on the destination address.

• High-end Cisco Layer 3 switches are now able to perform the second function at the same speed as the Layer 2 switching function.
• If a routing hop and additional segmentation is introduced in the network, there is no speed penalty.
• Benefits of converting the core switches to Layer 3:

1. no possibility for an STP loop
2. no ports are blocked
3. no speed penalty
4. redundancy is still present, with a reliance on Layer 3 routing protocols.

• There is a single drawback with switching to a Layer 3 design: the migration implies a rework of the addressing scheme.

Keep STP Even If It Is Unnecessary

• Even if there are no blocked ports or physical redundancy, do not disable STP.
• STP is generally not very processor-intensive.
• The few BPDUs sent on each link do not significantly reduce the available bandwidth.
• A network without STP can melt down in a fraction of a second if an operator makes an error on a patch panes, for example.
• Disabling STP is not worth the risk.

Keep Traffic off the Administrative VLAN and Do Not Have a Single VLAN Span the Entire Network

• A Cisco switch typically has a single IP address that binds it to a VLAN (administrative VLAN).
• In this VLAN, the switch behaves like a generic IP host.
• Every broadcast or multicast packet is forwarded to the CPU.
• A high rate of broadcast or multicast traffic can adversely impact the CPU and its capability to process vital BPDUs.
• Keep user traffic off the administrative VLAN.

References

Spanning Tree Protocol Problems and Related Design Considerations