Troubleshooting Trunk Links and Spanning Tree using Dia - Part 5 of 5

Welcome back to the conclusion of this series!

We are now on to VLAN 44 which will show just how useful making a spanning tree map in dia can be.

Just like on the previous posts, here is the original physical layer map:

And once again, let's start with the 'show spanning-tree vlan 44' command on DS1:

Only two of the six trunks are forwarding VLAN 44.  Gi0/1 is the root port back to the root switch and Gi0/2 is in the blocking state to prevent a loop.  First update to the map is as follows:

Next, the 'show spanning-tree vlan 44' command on DS2:

On DS2, we can see that all six trunks are forwarding VLAN 44 and that DS2 is the root switch.  The updated dia map is:

Forwarding on to AS1 and the 'show spanning-tree vlan 44' command:

Here, we can see that only two of the four links are being used for VLAN 44.  Fa0/13 is the root port back to DS2 and Fa0/14 is blocking to prevent a loop.  Of course, we document this on the map adding the circled-x on the end of the blocking port:

Last, we head over to AS2 and run the 'show spanning-tree vlan 44' command:

Now, we have some interesting information shown here.  Notice, AS2 believes it is the root switch for VLAN 44.  But we documented that DS2 is the root switch.  How is possible?

It is possible because AS2 doesn't have a connected neighbor using VLAN 44, but AS2 does have an active port on VLAN 44 (Fa0/21 and Fa0/22).  Since AS2 does not have a neighbor using VLAN 44 on their trunks (and AS2 is not using Fa0/23 or Fa0/24 on its trunk links up to DS2), AS2 believes it is the root switch for the VLAN.

Once we document this misconfiguration on the dia map, it becomes very clear.  Remember, I use the blue links to indicate that the VLAN is not on one end of the trunk link and the circled-x is used to indicate with end of the link the VLAN is not available on.

Because there are zero green links coming from AS2, it is clear that AS2 is cut off from the rest of the network on VLAN 44.

Now that Layer 2 is documented, let's verify where the HSRP Active router for the VLAN is located.  First, the 'show standby vlan 44' on DS1:

DS1 appears to the Standby router indicated by the 'State is Standby' and the 'Standby router is local' lines.  Let's verify that DS2 is indeed the Active HSRP router.

And DS2 is the Active router.  So, the finished map shows as:

---
Let's take a look at the finalized maps for each VLAN:

VLAN 1

VLAN 11

VLAN 22

VLAN 33

VLAN 44

So, now that we have our finalized maps, what would be some options to repair and optimize the current configurations?

At the beginning, I wrote that the odd numbered VLANs (1, 11 and 33) were going to use DS1 as the root switch for spanning tree and use DS1 as the HSRP Active Router and that the even numbered VLANs (22 and 44) were going to use DS2 as the root switch for spanning tree and use DS2 as the HSRP Active Router.  Additionally, when there are dual uplinks, I think it makes much more sense to utilize EtherChannels (logically combining two or more connections into a single connection).  EtherChannels optimize bandwidth (more connections toward the root switch) and simplifies the spanning tree instance (no blocking ports towards the root switch).

First off, this might be an opportune time to change the spanning tree protocol to rapid-pvst (rapid per VLAN spanning tree).

So, let's start there.  On each switch, we run the command 'spanning-tree mode rapid-pvst' in configuration mode:

When we change the spanning tree mode type, the spanning tree instance will need to reconverge and since the other switches are still in Per VLAN Spanning Tree (pvst), we will have to wait through the Listening and Learning stages before moving along to each switch.

We can see that the HSRP sessions break down as well.  Once spanning tree has reconverged, the HSRP sessions reconnect and routing is back online.  Once all four switches are running rapid-pvst, the following configuration changes will update the spanning tree much quicker.

Secondly, we will need to configure the trunk links to be identical (all the VLANs will need to be allowed on all the trunks).

The easiest way to do this is to use a range command on each switch that adds the line 'switchport trunk allowed vlan 1,11,22,33,44'

We can use the dia map to find out which ports can be added to the 'interface range' command instead of having to go through each port individually.  Remember, when a trunking command is added or changed, spanning tree will reconverge.  Obviously, this type of work needs to be done off-hours since the convergence will temporarily take down each VLAN.

Once each switch has identical allowed VLANs, it's time to plan our EtherChannels.  Again, dia can be used to help with this planning as well.

Under the SDL group of icons in dia, there is a circle that can be used to indicate an EtherChannel.

We can add the circles and change the shape into an oval and add a label to plan out the EtherChannel port numbers so the numbers don't overlap on the same switch.

There are a few different ways to configure EtherChannels (which will be a topic for another series).  So, for this article, let's just choose a quick configuration and move along.  Also, remember that when you change the configuration on one end of the links, the ports will go down until the other end is configured.  So, it is best to start with the remote end first so that you don't "cut your own arm off".

Once the EtherChannels are in place, it's time to make sure that the odd numbered VLANs are using DS1 as the root switch and that the even numbered VLANs are using DS2 as the root switch.

One of the many goofy things about spanning tree is that the 'priority' setting is backwards (at least in my way of thinking).  The switch with the LOWEST priority is the root switch (which is the opposite in the HSRP configuration).

Spanning Tree = lowest priority is the root switch
HSRP = highest priority is the root switch

So, when I set up a spanning-tree priority, I like to set the root switch with a priority of 4096, the secondary switch with a priority of 8192 and the other switches with a priority of 40960.

For DS1:

For the even numbered VLANs 22 and 44, we'll set the priority as 4096 on DS2, 8192 on DS1 and 40960 on the other two switches.

We can verify that spanning tree and HSRP are working as planned with the 'show spanning-tree summary' and 'show standby brief' commands:

We can see that DS1 is the Root bridge (root switch) for VLANs 1, 11 and 33 and is also the Active router for VLANs 1, 11 and 33.

DS2 confirms that it is the Root bridge (root switch) for VLANs 22 and 44 and is also the Active router for VLANs 22 and 44.

Now that we have the rapid-pvst running, the trunks configured, EtherChannels set up and the spanning tree priorities configured, our final maps look like this:

Odd numbered VLANs (1, 11, 33):

Even numbered VLANs (22, 44):

---

I sincerely hope that you download and become comfortable with using dia and that this series has been helpful to you in learning, configuring and troubleshooting trunks and spanning-tree instances.

Thank you for reading!

Troubleshooting Trunk Links and Spanning Tree using Dia - Part 4 of 5

Welcome back!

Continuing this series on using dia to troubleshoot trunk links and spanning tree instances, let's move on to VLAN 33.

Once again, here is the physical layer topology:

By now, we have our routine.  Start with the 'show spanning-tree vlan 33' command:

Here, we can see that DS1 is the root switch and that four of the six trunks have VLAN 33 allowed.  The first update to the map follows:

Over to DS2 next and the 'show spanning-tree vlan 33' command:

A very similar configuration here.  DS2 is utilizing the Gigabit connections back to DS1 (the root switch), and the connections to AS2 are forwarding traffic for VLAN 33 as well.  Gi0/1 i1 is the root port and Gi0/2 is blocking to prevent a loop.  The updated map is now:

Next, AS1 and the 'show spanning-tree vlan 33' command:

Here we see that only two of the four trunk links are utilized.  Fa0/11 is the root port back to DS1 and Fa0/12 is in the blocking state to prevent a loop.  Again, the updated map:

Last, let's head over to AS2 to finish the map:

And here we can see a similar configuration as AS1.  Two of the four uplinks are utilized, but this time up to DS2.  Fa0/23 is the root port and Fa0/24 is blocking to prevent a loop.

Now that we have the Layer 2 topology sorted, let's verify the HSRP Active router.

On DS1, we run the 'show standby vlan 33' command:

Right away we can see that DS1 is the Active HSRP router with the 'State is Active' and 'Active router is local' lines.

While this configuration is not the most efficient (unused trunk links directly connected to the two distribution switches), this VLAN is not in too bad of shape.  Again, AS2 has to use an extra switch in the path (DS2) in order to reach the Active router, but overall not too bad.

The obvious fixes would be to allow VLAN 33 on all the links and change all of these dual uplinks into Etherchannels.

Next post will cover VLAN 44 and then the final configuration to implement all the fixes.

Thank you for reading!

Troubleshooting Trunk Links and Spanning Tree using Dia - Part 3 of 5

Welcome back!

Part 3 will cover VLAN 22.  Again, this is intentionally misconfigured to show how to use dia to document a spanning tree instance and to help find any problems.

Again, let's start with the base map that shows all the physical connections:

Just like on Part 1 and Part 2, let's start with a 'show spanning-tree vlan 22' command on DS1:

First thing we can see is that DS1 is the spanning tree root switch and that Gi0/1 and Gi0/2 are not involved in this instance.  Let's document the links on the dia map.

On to DS2.  Again starting with the 'show spanning-tree vlan 22' command:

The trunks are a little different on this switch.  All six connections are involved with the spanning tree instance for VLAN 22.  Fa0/13 is the root port and Fa0/14 is blocking to prevent a loop between DS2 and AS1.  Let's document this on the map.

Note that the blue Gigabit links are showing that DS2 is forwarding traffic but that the VLAN is not allowed on the trunk link configuration on DS1.  The circled-x's are used to show which end of the connection does not have the VLAN allowed on the port.  The red link is used to show that one end of the connection is in a blocking state.  The arrow on the Fa0/13 from DS2 to AS1 is used to show which port is the root port back to the root switch (DS1 on this VLAN).

Let's head over to AS1:

No surprises here.  Fa0/11 is the root port back to DS1, Fa0/12 is blocking to prevent a loop and both ports to DS2 are forwarding.

Last, let's head over to AS2:

Here we see that only two of the trunk links are forwarding for VLAN 22:  Fa0/21 and Fa0/22 over to DS1.

So now we have a complete picture of the Layer 2 spanning tree topology.  Next, let's check out how HSRP is configured.

On DS1, we can see that DS1 is running as the standby HSRP router for VLAN 22.  Let's check DS2 to verify.

And DS2 confirms that DS2 is indeed the HSRP active router for VLAN 22.

So, what does this mean?

Well, spanning tree is used only for loop prevention.  Spanning tree doesn't care that the default router is not the spanning tree loop.  So, in this case, any traffic originating from AS2 will go through DS1, then to AS1, then to DS2 exit the VLAN.

We can update the map to show that spanning has converged correctly, but that DS2 is the default gateway out of the VLAN, like so:

With this final map, we can see that spanning tree is using DS1 as the root bridge but that DS2 is the default gateway.  I've turned the arrows around to point to DS2 as the default gateway and increased the size of the link between DS2 and AS1 to show that we have a really inefficient configuration for this VLAN.  From AS2's perspective, all traffic goes to DS1 since that is the root switch, but then DS1 will have to send the frame to DS2 to exit the VLAN (such as traffic heading to the Internet).  On this VLAN, AS1 then becomes a transit switch instead a pure access layer switch.

So, what should be done to fix this unfortunate configuration?

First, DS2 should either be set as the root switch or changed to be the HSRP standby router for the VLAN.  Second, VLAN 22 should be added to all the trunk links so that VLAN 22 traffic can be sent directly to the HSRP active router and to make use of the Gigabit connections between DS1 and DS2.

Part 4 will tackle VLAN 33.

Thank you for reading!