https://community.extremenetworks.com/t5/network-architecture-design/exos-using-mstp-port-vlan-change-breaking-spanning-tree/m-p/15397#M2352 Edited with more detail.................<BR /> <BR /> In EXOS using MSTP there is no means of directly mapping a<BR /> Vlan directly to an MSTI or configuring a port as edge or point-to-point, until<BR /> you associate a Vlan to port – which causes a few problems:<BR /> <BR /> 1st Problem<BR /> <BR /> This materialises when you have two core switches and you have all the Vlans added to the ports that link them together – the core then shows each Vlan participating. On the edge you only add Vlans to the Uplink ports that you want to use, so the participating Vlans only include them. The fact will be the MSTP digest will NOT match, and therefore MSTP will not work properly. This is because although you have correctly configured MSTP and Vlan’s to match on both the core and edge, with auto-bind configured as to what Vlan belongs to what MSTI, the Vlan’s not added to the uplink ports (because you are not using those Vlans on that edge switch) doesn’t get added as participating, which the digest is calculated from. <BR /> <BR /> So in essence a Vlan does not get mapped to a MSTI UNTIL you add it to a port! As far as I know there is no way around this, so to get around it I have added all the Vlans to the uplinks on the edge, but on the core I only add those that I need.<BR /> <BR /> 2nd Problem<BR /> <BR /> You cannot configure a port as an edge port UNTIL you have added a Vlan to the port. This will become apparent in problem 3. This is a problem, as an example at pre-stage is that you might not know what Vlan you are going to add to the port but want to protect anyway be configuring it as an edge port. The other example is that you might later change the Vlan of a port and therefore have to reconfigure the edge protection again as per problem 3.<BR /> <BR /> 3nd Problem (What this thread is questioning)<BR /> <BR /> So with the 1st and 2nd problem in mind, when changing the Vlan of a port that is subsequently associated to another MSTI (STP domain), you have to reconfigured the port to tell it to use that domain. If you don't the port is not set as an edge port and any port state change (like PC turned on or off) triggers a TCN and subsequent topology change!<BR /> <BR /> So the process is you already have a Vlan (‘Sales) associated to a port (2:47) and the ‘Sales’ Vlan has been auto-bind to STP domain of S1. You have already configured MSTP appropriately and also auto bind every other Vlan to either S1 or S2. <BR /> <BR /> Now that port 2:47 is configured for Vlan ‘Sales’ untagged. You now want to configure that port as an edge port and issue the following command:<BR /> <BR /> configure stpd s0 ports link-type edge 2:47 edge-safeguard enable bpdu-restrict Which in effect does the following (in part) due to the configuration being inherited to the other MSTI’s:<BR /> <BR /> configure stpd s0 ports mode dot1d 2:47<BR /> configure stpd s0 ports cost auto 2:47<BR /> configure stpd s0 ports port-priority 128 2:47<BR /> configure stpd s0 ports link-type edge 2:47<BR /> configure stpd s0 ports edge-safeguard enable 2:47<BR /> configure stpd s0 ports bpdu-restrict enable 2:47<BR /> configure stpd s0 ports restricted-role disable 2:47<BR /> configure stpd s0 ports active-role disable 2:47<BR /> configure stpd s0 ports loop-protect off 2:47<BR /> configure stpd s0 ports loop-protect partner incapable 2:47<BR /> configure stpd s0 ports auto-edge on 2:47<BR /> configure stpd s0 ports restricted-tcn off 2:47<BR /> enable stpd s0 ports 2:47<BR /> configure stpd s1 ports mode dot1d 2:47<BR /> configure stpd s1 ports cost auto 2:47<BR /> configure stpd s1 ports port-priority 128 2:47<BR /> configure stpd s1 ports link-type edge 2:47<BR /> configure stpd s1 ports edge-safeguard enable 2:47<BR /> configure stpd s1 ports restricted-role disable 2:47<BR /> configure stpd s1 ports active-role disable 2:47<BR /> configure stpd s1 ports loop-protect off 2:47<BR /> configure stpd s1 ports loop-protect partner incapable 2:47<BR /> configure stpd s1 ports auto-edge on2:47<BR /> configure stpd s1 ports restricted-tcnoff 2:47<BR /> enable stpd s1 ports 2:47<BR /> Now the problem occurs when you change the Vlan on port 2:47 to say ‘Technical’ and that is auto-bind to s2. When you change the Vlan to that port there is now no configuration for s2, so you have to reissue the command below again:<BR /> <BR /> configure stpd s0 ports mode dot1d 2:47<BR /> configure stpd s0 ports cost auto 2:47<BR /> configure stpd s0 ports port-priority 128 2:47<BR /> configure stpd s0 ports link-type edge 2:47<BR /> configure stpd s0 ports edge-safeguard enable 2:47<BR /> configure stpd s0 ports bpdu-restrict enable 2:47<BR /> configure stpd s0 ports restricted-role disable 2:47<BR /> configure stpd s0 ports active-role disable 2:47<BR /> configure stpd s0 ports loop-protect off 2:47<BR /> configure stpd s0 ports loop-protect partner incapable 2:47<BR /> configure stpd s0 ports auto-edge on 2:47<BR /> configure stpd s0 ports restricted-tcn off 2:47<BR /> enable stpd s0 ports 2:47<BR /> configure stpd s2 ports mode dot1d 2:47<BR /> configure stpd s2 ports cost auto 2:47<BR /> configure stpd s2 ports port-priority 128 2:47<BR /> configure stpd s2 ports link-type edge 2:47<BR /> configure stpd s2 ports edge-safeguard enable 2:47<BR /> configure stpd s2 ports restricted-role disable 2:47<BR /> configure stpd s2 ports active-role disable 2:47<BR /> configure stpd s2 ports loop-protect off2:47<BR /> configure stpd s2 ports loop-protect partner incapable 2:47<BR /> configure stpd s2 ports auto-edge on 2:47<BR /> configure stpd s2 ports restricted-tcn off 2:47<BR /> enable stpd s1 ports 2:47<BR /> So, is there anyway around this – like there is the auto-bind command to automatically bind a Vlan to an STP domain.<BR /> <BR /> To give an example, this is how the config for port 13 is now with the Vlan Data_102 belonging to S2:<BR /> <BR /> Edge1.1 # show config | include 13<BR /> configure vlan Data_102 add ports 13-24 untagged<BR /> configure vlan Voice_502 add ports 1-2,13-24 tagged<BR /> configure stpd s0 ports port-priority 128 13<BR /> configure stpd s0 ports link-type edge 13<BR /> configure stpd s0 ports edge-safeguard enable 13<BR /> enable stpd s0 ports 13<BR /> configure stpd s2 ports mode dot1d 13<BR /> configure stpd s2 ports port-priority 128 13<BR /> configure stpd s2 ports link-type edge 13<BR /> configure stpd s2 ports edge-safeguard enable 13<BR /> enable stpd s2 ports 13Now I configured port 13 to belong to Vlan Data_101 that belongs to S1:<BR /> <BR /> Edge1.2 # configure vlan Data_102 delete ports 13Edge1.2 # configure vlan Data_101 add ports 13Now when you look at the STP config you will notice that although port 13 has moved to a Vlan that belongs to S1 it still show config for S2:<BR /> <BR /> Edge1.4 # show config | include 13<BR /> disable port 13<BR /> configure vlan Voice_502 add ports 1-2,13-24 tagged<BR /> configure stpd s0 ports port-priority 128 13<BR /> configure stpd s0 ports link-type edge 13<BR /> configure stpd s0 ports edge-safeguard enable 13<BR /> enable stpd s0 ports 13<BR /> configure stpd s2 ports mode dot1d 13<BR /> configure stpd s2 ports port-priority 128 13<BR /> configure stpd s2 ports link-type edge 13<BR /> configure stpd s2 ports edge-safeguard enable 13<BR /> enable stpd s2 ports 13So to get around it you have to re-run the following <BR /> <BR /> Edge1.90 # configure stpd s0 ports link-type edge 13 edge-safeguard enable bpdu-restrict<BR /> Now the config is populated correctly. The Vlan Voice_502 is in S2 hence why S2 config persists for the port, but you will observe S1 config has appeared:<BR /> <BR /> Edge1.91 # show config | include 13<BR /> configure vlan Data_101 add ports 3-13 untagged<BR /> configure vlan Voice_502 add ports 1-2,13-24 tagged<BR /> configure stpd s0 ports port-priority 128 13<BR /> configure stpd s0 ports link-type edge 13<BR /> configure stpd s0 ports edge-safeguard enable 13<BR /> enable stpd s0 ports 13<BR /> configure stpd s1 ports mode dot1d 13<BR /> configure stpd s1 ports port-priority 128 13<BR /> configure stpd s1 ports link-type edge 13<BR /> configure stpd s1 ports edge-safeguard enable 13<BR /> enable stpd s1 ports 13<BR /> configure stpd s2 ports mode dot1d 13<BR /> configure stpd s2 ports port-priority 128 13<BR /> configure stpd s2 ports link-type edge 13<BR /> configure stpd s2 ports edge-safeguard enable 13<BR /> enable stpd s2 ports 13If you remove the port from the Vlan the STP config disappears:<BR /> <BR /> Edge1.96 # configure vlan data_101 delete ports 13Warning: STP port (13) is lost due to port is deleted from VLAN.Edge1.97 # show config | include 13<BR /> configure vlan Voice_502 add ports 1-2,13-24 tagged<BR /> configure stpd s0 ports port-priority 128 13<BR /> configure stpd s0 ports link-type edge 13<BR /> configure stpd s0 ports edge-safeguard enable 13<BR /> enable stpd s0 ports 13<BR /> configure stpd s2 ports mode dot1d 13<BR /> configure stpd s2 ports port-priority 128 13<BR /> configure stpd s2 ports link-type edge 13<BR /> configure stpd s2 ports edge-safeguard enable 13<BR /> enable stpd s2 ports 13<BR /> So hopefully you get the point in moving ports Vlans does not update the STP config.<BR /> <BR /> Have played around with the following commands to automate the process but neither have worked:<BR /> <BR /> configure stpd "s0" ports auto-edge on 13configure stpd s0 ports link-type auto 13Many thanks in advance. Mon, 25 Apr 2016 17:33:00 GMT Anonymous 2016-04-25T17:33:00Z https://community.extremenetworks.com/t5/network-architecture-design/exos-using-mstp-port-vlan-change-breaking-spanning-tree/m-p/15397#M2352 Edited with more detail.................<BR /> <BR /> In EXOS using MSTP there is no means of directly mapping a<BR /> Vlan directly to an MSTI or configuring a port as edge or point-to-point, until<BR /> you associate a Vlan to port – which causes a few problems:<BR /> <BR /> 1st Problem<BR /> <BR /> This materialises when you have two core switches and you have all the Vlans added to the ports that link them together – the core then shows each Vlan participating. On the edge you only add Vlans to the Uplink ports that you want to use, so the participating Vlans only include them. The fact will be the MSTP digest will NOT match, and therefore MSTP will not work properly. This is because although you have correctly configured MSTP and Vlan’s to match on both the core and edge, with auto-bind configured as to what Vlan belongs to what MSTI, the Vlan’s not added to the uplink ports (because you are not using those Vlans on that edge switch) doesn’t get added as participating, which the digest is calculated from. <BR /> <BR /> So in essence a Vlan does not get mapped to a MSTI UNTIL you add it to a port! As far as I know there is no way around this, so to get around it I have added all the Vlans to the uplinks on the edge, but on the core I only add those that I need.<BR /> <BR /> 2nd Problem<BR /> <BR /> You cannot configure a port as an edge port UNTIL you have added a Vlan to the port. This will become apparent in problem 3. This is a problem, as an example at pre-stage is that you might not know what Vlan you are going to add to the port but want to protect anyway be configuring it as an edge port. The other example is that you might later change the Vlan of a port and therefore have to reconfigure the edge protection again as per problem 3.<BR /> <BR /> 3nd Problem (What this thread is questioning)<BR /> <BR /> So with the 1st and 2nd problem in mind, when changing the Vlan of a port that is subsequently associated to another MSTI (STP domain), you have to reconfigured the port to tell it to use that domain. If you don't the port is not set as an edge port and any port state change (like PC turned on or off) triggers a TCN and subsequent topology change!<BR /> <BR /> So the process is you already have a Vlan (‘Sales) associated to a port (2:47) and the ‘Sales’ Vlan has been auto-bind to STP domain of S1. You have already configured MSTP appropriately and also auto bind every other Vlan to either S1 or S2. <BR /> <BR /> Now that port 2:47 is configured for Vlan ‘Sales’ untagged. You now want to configure that port as an edge port and issue the following command:<BR /> <BR /> configure stpd s0 ports link-type edge 2:47 edge-safeguard enable bpdu-restrict Which in effect does the following (in part) due to the configuration being inherited to the other MSTI’s:<BR /> <BR /> configure stpd s0 ports mode dot1d 2:47<BR /> configure stpd s0 ports cost auto 2:47<BR /> configure stpd s0 ports port-priority 128 2:47<BR /> configure stpd s0 ports link-type edge 2:47<BR /> configure stpd s0 ports edge-safeguard enable 2:47<BR /> configure stpd s0 ports bpdu-restrict enable 2:47<BR /> configure stpd s0 ports restricted-role disable 2:47<BR /> configure stpd s0 ports active-role disable 2:47<BR /> configure stpd s0 ports loop-protect off 2:47<BR /> configure stpd s0 ports loop-protect partner incapable 2:47<BR /> configure stpd s0 ports auto-edge on 2:47<BR /> configure stpd s0 ports restricted-tcn off 2:47<BR /> enable stpd s0 ports 2:47<BR /> configure stpd s1 ports mode dot1d 2:47<BR /> configure stpd s1 ports cost auto 2:47<BR /> configure stpd s1 ports port-priority 128 2:47<BR /> configure stpd s1 ports link-type edge 2:47<BR /> configure stpd s1 ports edge-safeguard enable 2:47<BR /> configure stpd s1 ports restricted-role disable 2:47<BR /> configure stpd s1 ports active-role disable 2:47<BR /> configure stpd s1 ports loop-protect off 2:47<BR /> configure stpd s1 ports loop-protect partner incapable 2:47<BR /> configure stpd s1 ports auto-edge on2:47<BR /> configure stpd s1 ports restricted-tcnoff 2:47<BR /> enable stpd s1 ports 2:47<BR /> Now the problem occurs when you change the Vlan on port 2:47 to say ‘Technical’ and that is auto-bind to s2. When you change the Vlan to that port there is now no configuration for s2, so you have to reissue the command below again:<BR /> <BR /> configure stpd s0 ports mode dot1d 2:47<BR /> configure stpd s0 ports cost auto 2:47<BR /> configure stpd s0 ports port-priority 128 2:47<BR /> configure stpd s0 ports link-type edge 2:47<BR /> configure stpd s0 ports edge-safeguard enable 2:47<BR /> configure stpd s0 ports bpdu-restrict enable 2:47<BR /> configure stpd s0 ports restricted-role disable 2:47<BR /> configure stpd s0 ports active-role disable 2:47<BR /> configure stpd s0 ports loop-protect off 2:47<BR /> configure stpd s0 ports loop-protect partner incapable 2:47<BR /> configure stpd s0 ports auto-edge on 2:47<BR /> configure stpd s0 ports restricted-tcn off 2:47<BR /> enable stpd s0 ports 2:47<BR /> configure stpd s2 ports mode dot1d 2:47<BR /> configure stpd s2 ports cost auto 2:47<BR /> configure stpd s2 ports port-priority 128 2:47<BR /> configure stpd s2 ports link-type edge 2:47<BR /> configure stpd s2 ports edge-safeguard enable 2:47<BR /> configure stpd s2 ports restricted-role disable 2:47<BR /> configure stpd s2 ports active-role disable 2:47<BR /> configure stpd s2 ports loop-protect off2:47<BR /> configure stpd s2 ports loop-protect partner incapable 2:47<BR /> configure stpd s2 ports auto-edge on 2:47<BR /> configure stpd s2 ports restricted-tcn off 2:47<BR /> enable stpd s1 ports 2:47<BR /> So, is there anyway around this – like there is the auto-bind command to automatically bind a Vlan to an STP domain.<BR /> <BR /> To give an example, this is how the config for port 13 is now with the Vlan Data_102 belonging to S2:<BR /> <BR /> Edge1.1 # show config | include 13<BR /> configure vlan Data_102 add ports 13-24 untagged<BR /> configure vlan Voice_502 add ports 1-2,13-24 tagged<BR /> configure stpd s0 ports port-priority 128 13<BR /> configure stpd s0 ports link-type edge 13<BR /> configure stpd s0 ports edge-safeguard enable 13<BR /> enable stpd s0 ports 13<BR /> configure stpd s2 ports mode dot1d 13<BR /> configure stpd s2 ports port-priority 128 13<BR /> configure stpd s2 ports link-type edge 13<BR /> configure stpd s2 ports edge-safeguard enable 13<BR /> enable stpd s2 ports 13Now I configured port 13 to belong to Vlan Data_101 that belongs to S1:<BR /> <BR /> Edge1.2 # configure vlan Data_102 delete ports 13Edge1.2 # configure vlan Data_101 add ports 13Now when you look at the STP config you will notice that although port 13 has moved to a Vlan that belongs to S1 it still show config for S2:<BR /> <BR /> Edge1.4 # show config | include 13<BR /> disable port 13<BR /> configure vlan Voice_502 add ports 1-2,13-24 tagged<BR /> configure stpd s0 ports port-priority 128 13<BR /> configure stpd s0 ports link-type edge 13<BR /> configure stpd s0 ports edge-safeguard enable 13<BR /> enable stpd s0 ports 13<BR /> configure stpd s2 ports mode dot1d 13<BR /> configure stpd s2 ports port-priority 128 13<BR /> configure stpd s2 ports link-type edge 13<BR /> configure stpd s2 ports edge-safeguard enable 13<BR /> enable stpd s2 ports 13So to get around it you have to re-run the following <BR /> <BR /> Edge1.90 # configure stpd s0 ports link-type edge 13 edge-safeguard enable bpdu-restrict<BR /> Now the config is populated correctly. The Vlan Voice_502 is in S2 hence why S2 config persists for the port, but you will observe S1 config has appeared:<BR /> <BR /> Edge1.91 # show config | include 13<BR /> configure vlan Data_101 add ports 3-13 untagged<BR /> configure vlan Voice_502 add ports 1-2,13-24 tagged<BR /> configure stpd s0 ports port-priority 128 13<BR /> configure stpd s0 ports link-type edge 13<BR /> configure stpd s0 ports edge-safeguard enable 13<BR /> enable stpd s0 ports 13<BR /> configure stpd s1 ports mode dot1d 13<BR /> configure stpd s1 ports port-priority 128 13<BR /> configure stpd s1 ports link-type edge 13<BR /> configure stpd s1 ports edge-safeguard enable 13<BR /> enable stpd s1 ports 13<BR /> configure stpd s2 ports mode dot1d 13<BR /> configure stpd s2 ports port-priority 128 13<BR /> configure stpd s2 ports link-type edge 13<BR /> configure stpd s2 ports edge-safeguard enable 13<BR /> enable stpd s2 ports 13If you remove the port from the Vlan the STP config disappears:<BR /> <BR /> Edge1.96 # configure vlan data_101 delete ports 13Warning: STP port (13) is lost due to port is deleted from VLAN.Edge1.97 # show config | include 13<BR /> configure vlan Voice_502 add ports 1-2,13-24 tagged<BR /> configure stpd s0 ports port-priority 128 13<BR /> configure stpd s0 ports link-type edge 13<BR /> configure stpd s0 ports edge-safeguard enable 13<BR /> enable stpd s0 ports 13<BR /> configure stpd s2 ports mode dot1d 13<BR /> configure stpd s2 ports port-priority 128 13<BR /> configure stpd s2 ports link-type edge 13<BR /> configure stpd s2 ports edge-safeguard enable 13<BR /> enable stpd s2 ports 13<BR /> So hopefully you get the point in moving ports Vlans does not update the STP config.<BR /> <BR /> Have played around with the following commands to automate the process but neither have worked:<BR /> <BR /> configure stpd "s0" ports auto-edge on 13configure stpd s0 ports link-type auto 13Many thanks in advance. Mon, 25 Apr 2016 17:33:00 GMT https://community.extremenetworks.com/t5/network-architecture-design/exos-using-mstp-port-vlan-change-breaking-spanning-tree/m-p/15397#M2352 Anonymous 2016-04-25T17:33:00Z https://community.extremenetworks.com/t5/network-architecture-design/exos-using-mstp-port-vlan-change-breaking-spanning-tree/m-p/15398#M2353 Martin,<BR /> <BR /> Hope all is well with you. <BR /> <BR /> I understand you have a case open for this with Alex R (he mentioned it was being looked at by Engineering). The invite is still open to you to come to the lab and test this out. <BR /> <BR /> Hope to see you soon.<BR /> <BR /> Ian...<BR /> <BR /> Tue, 17 May 2016 18:29:00 GMT https://community.extremenetworks.com/t5/network-architecture-design/exos-using-mstp-port-vlan-change-breaking-spanning-tree/m-p/15398#M2353 Ian 2016-05-17T18:29:00Z https://community.extremenetworks.com/t5/network-architecture-design/exos-using-mstp-port-vlan-change-breaking-spanning-tree/m-p/15399#M2354 Hi Martin,<BR /> <BR /> Have you gotten any solution for your questions?<BR /> I've got related issues, particularly your problem 1: <A href="https://community.extremenetworks.com/extreme/topics/mstp-in-a-rapidly-changing-environment?rfm=1&amp;#38;topic_submit=true" target="_blank" rel="nofollow noreferrer noopener">https://community.extremenetworks.com/extreme/topics/mstp-in-a-rapidly-changing-environment?rfm=1&amp;am...</A><BR /> <BR /> Mon, 05 Sep 2016 17:21:00 GMT https://community.extremenetworks.com/t5/network-architecture-design/exos-using-mstp-port-vlan-change-breaking-spanning-tree/m-p/15399#M2354 vobelic 2016-09-05T17:21:00Z