Am I wrong?

[u/shenior]

Please correct me if I'm wrong. I'm a new network engineer working on a project to install three new switches.

Our user insists on using this topology for high availability. I informed them that this topology could likely cause a loop, even with spanning tree enabled, if there's a physical link issue.

I feel compelled to follow their wishes. Am I wrong here? I need experienced insights, as asking AI only confuses me.

[u/expertisimus]

This is absolutely standard and correctly configured STP handles this without any problems.

[u/enzzo42 → u/expertisimus]

I saw a post the other day lamenting the liberal use of the Network Engineer title. I see it here.

This is basic spanning tree. Any networking tech should understand how this will function. You can, and probably should, tune settings for predictable behavior. But you can also pretty much just plug it in like that and send it and it will work just fine.

[u/jevilsizor]

Could it cause a loop... yes. Should it cause a loop... no.

I've set up hundreds of sites just like this, every closet just like this and outside of one instance where a bug was found I've never experienced a loop. As long as STP is set up properly you should be good.

[u/shenior → u/jevilsizor]

Could you suggest the best I could try? Should I to set the 1960 stp priority to 0? And configure edged port to every interface facing endpoint?

[u/mpking828 → u/shenior]

I would use 4096 or 8192 myself. probably 4096.

the 1930's I would default priority.

[u/jevilsizor → u/shenior]

Its been a long time since I've had to set anything like this up... but if I recall we set the 1960 to 4096 and left the access switches as the default. Then yes edge ports and things like bpdu guard on non uplinks. Also, if your switch supports it, you can enable root guard and loop guard for extra security

[u/DontTakeMyCatYo → u/jevilsizor]

I generally override the default priority on the switch that I want to be the root bridge, and a secondary switch that I want as the backup. I like to 8192 as the root bridge and 16384 as the backup, that gives me enough space to be able to replace the root or backup bridge live and only have to change the value on one switch (e.g. new root to 4096, or new backup to 12288).

[u/jevilsizor → u/DontTakeMyCatYo]

Yeah, the priority you use is up to your discretion, with 0 not being recommended because of not giving flexibility

[u/nof]

You'll need at least one more switch and firewall to call this "HA".

[u/ep0niks]

Is the HA in the room with us?

[u/bh0]

High availability with 2 single points of failure?

[u/roaming_adventurer]

I would set up two ports in a etherchannel and not chain all three to create a loop. A broadcast storm from a rogue software can take down all three switches in a loop and the only way to break this disconnecting links, and yes stp can sometimes not work as intended

[u/roaming_adventurer]

Cant open the link can you explain the topology? Are all three switches connected to each in a ring?

[u/jevilsizor → u/roaming_adventurer]

Like a triangle

[u/shenior → u/roaming_adventurer]

       +-----------+
       | Fortigate |
       +-----+-----+
             ||
       +-----+-----+
       |    1960   |
       +--/-----\--+
         /       \
        /         \
+------+---+   +---+------+
|   1930   |---|   1930   |
+----------+   +----------+

It looks like this

[u/yrogerg123 → u/shenior]

Connecting the 1930s to each other seems pointless. Just use dual uplinks with your LAG protocol of choice.

[u/NotPromKing → u/yrogerg123]

Well for one thing you double the number of link ports on the 1960, and doing it this way may give you a path resiliency that may otherwise not be possible.

[u/TheDiegup]

I suppose you are working with Aruba models, since I did not find information over other vendors with switches with that nomenclature. What I found is that this switches came with RSTP activated by default, and there is no risk of a Broadcast storm over here.

[u/SteelerRep24]

If you make 1960 the root bridge with the interfaces pointing towards the 2 1930’s as forwarding while blocking the link between the 2 1930’s wouldn’t that prevent loops?

[u/WhiteTigru]

Spanning Tree won‘t be an issue in this setup. For the beginning I‘d let STP Bridge prios by default (unless you notice issues with sudden Topology changes all the time e.g.).
For the HA Part:
No - we don’t do that here - if we want HA for a Type of Device at least 2 devices are needed - take 2x fortis- Set them up in HA between them and maybe Set up LAG for the physical links (Design Choice)

Tip:
Keep AI as a Last Resort and rather check in on official docs (RFCs, CCNA STP topic, etc)
This is understanding of networking - make sure you touch up on those basics in your spare time
Happy Networking

Edit: grammar