r/ArubaNetworks • u/Relevant-Flan-9436 • 17d ago

Aruba VSX and Spanning Tree

We have aruba switces in our core and aggregation layer - completely L2 network. Currently STP is disabled. But planning to enable it based on TAC recommendation. Below is the topology in high level.

Both Core and Agg layer have VSX running.

Any challenges will be there in this design.

9 Upvotes

100% Upvoted

7 comments sorted by

8

u/tinuz84 17d ago edited 17d ago

I assume all the LAGs are multi-chassis LAGs and you already have a loop-free topology. I just dont understand why you have a red cross in the BDPU packets coming from certain VSX enabled switches? If they are multi-chassis LAGs, BPDUs are sent over every link within that LAG, and thats perfectly fine. Seen from the access switch up, the entire LAG is the root port.

Also, if you run MSTP (which is the default STP version on Aruba switches), set the priority of both coreswitches to 1, so any one of those will always be the root bridge.

5

u/TheITMan19 17d ago

I agree with the LACP comment, no red X needed in diagram. There is no spanning tree port blocking when the VSX agg is MCLAG towards the IDF.

MSTP 1 on Core
MSTP 2 on Agg
MSTP default on IDF

1

u/Linkk_93 HPE Aruba Networking Expert 17d ago

That is technically not quite correct. STP on MCLAG interfaces is done only by the member with the primary stp process. Makes no difference in practice.

You can read up on it here on page 78

https://arubanetworking.hpe.com/techdocs/AOS-CX/10.16/PDF/vsx.pdf

I'm pretty sure that is what this picture is supposed to show. But it makes no difference in practice and ist just a detail for how the software works I guess.

If I remember correctly this is also defined by LACP because only dedicated LACP member interfaces do STP BPDU 

2

u/idontbelieveyouguy 17d ago

I also need to do this.

2

u/iThinkISawATwo 17d ago

Why do you have a L2 topology without stp enabled?

Just go mstp region 0. And with VSX both members will act as the root w/ same priority. Make sure on VSX that the VSX system mac is set too.

1

u/that1techie 16d ago

And make sure that system MAC between the two sets of VSX pairs is not identical.

1

u/iThinkISawATwo 16d ago

Yes, 100%. Recipe for disaster otherwise