I have very strange scenario here which you can see in diagram.
SW1/2 is Cisco nexus 3064PQ switch configured in vPC and those switch connected to SW3/4 ( HP 6120XG ) switches on HP c7000 blade center, I have vpc11 configured to create multi-chassis etherchannel.
following is my configuration for vPC connected to c7000
interface port-channel11
description *** VPC to c7000-sw3 ***
switchport mode trunk
switchport trunk allowed vlan 10-11,20-21,28-31,40,50,100,200
speed 10000
vpc 11
now can i configure spanning-tree port type edge trunk
on port-channel11
interface? ( is it safe? )
that switch is leaf switch and not connected to any other switch, pretty much switch acting like host machine, reason i want to do that because whenever i reboot that switch it generating spanning-tree change and that causing small amount of flood in network, i want to do some testing and possible i reboot that switch couple of time.
Best Answer
SW3 is a switch. By first principle,
portfast [trunk]
orport type edge [trunk]
should not be enabled on ports that connect to switches, lest you risk loops if that other switch connects to some other upstream switch.There are exceptions to this rule, but they require solid knowledge and understanding by the network admin.
Usually, deployment of edge ports combine
portfast [trunk]
andbpduguard
, and in that case, SW3's BPDUs would put Port-Channel11err-disabled
state.Remember, that even with full VPC deployments, it is recommended to keep Spanning-Tree running in the background as a safety net, to help if things go wrong. Setting
portfast
on an inter switch link (or adding bpdufilter, see below) makes this safety net weaker.So, if you are willing to take some risk, and work with diligence, you may enable
portfast
orport type edge [trunk]
on a switch port that connects to another switch.Please make sure that
With Multi Chassis LAG setups, this might be tricky to achieve.
In your case, on the Cisco VPC pair, you must make sure that the member interfaces of the port-channel downwards towards SW3 never come up as individual or non-bundled ports.
Forcing LACP
mode active
together withlacp suspend-individual
should accomplish this. Note: Nexus 5500 have this as default with NX-OS >7.2.1 and Nexus 3164Q (and probably many 9300s), too. You'll have to check with your 3064. If that 3064 can't dolacp-suspend-indiviudal
, stop right there.It's definitely not a setup for the faint-hearted. Be certain to include in documentation that SW3 must NEVER be uplinked to any other switch than this VPC pair, as long as this setup prevails.
Additionally, you may want to add some protection against SW3 interfering with the spanning-tree instances of the upstream switches, by adding
Or even this:
Sideline question: Does that HP switch in that Chassis run MST, while the 3064 and its upstreams run Rapid-PVST? If different STP protocols, did you consider the interoperability issues?