Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Having a strange issue with STP that I cannot seem to pin down with the following topology:

          -------881 ------- Public WAN ----- 881---  
    Switch1                                         Swith2
          --------2911--------Private leased line----
                             provided by isp

I am trying to extend a layer 2 network between two remote sites, the two bottom routers are cisco 2911's connected through a leased line from the ISP. The two routers at the top are cisco 881's connected over an encrypted VPN tunnel over public WAN. The 881 link is supposed to serve as a backup link to the link between 2911s.

Using pesudowire I have set up the network such that STP packets can freely flow between the switched, simulating a LAN. I can see BPDUs being sent and received in appropriate locations however there seems to be a problem with failing over to the secondary link when the primary goes down in a certain way.

Operating normally the non-root switch (on the right) blocks its link to the 881, getting rid of the loop. When the link between the switch and the 2911 is broken STP unblocks the port and traffic between the two sites flows normally.

However, when the link between the two 2911's is broken STP cannot seem to switch over to the other link and traffic stops transmitting between the 2 sites.

Think there might be something about the STP configuration since traffic seems to be flowing as expected until a failure but I can't be sure anymore. Any ideas with something similar would be great.


share|improve this question

migrated from Jul 31 '12 at 0:12

This question came from our site for professional and enthusiast programmers.

First, this is offtopic for Stack Overflow, you should delete the question and repost on Server Fault. Second, we need to see router configs – Mike Pennington Jul 30 '12 at 18:58

There are a few different ways to approach this issue, but without knowing more about the specific switch and router configurations it's hard to figure out the -best- way. That said, an easy way to approach this issue is interface tracking on the 2911. With this approach the Ethernet interfaces on the 2911 will drop when the leased line goes down - effectively duplicating the working use-case mentioned above. Try checking out this page on CCO for details on configuration.

If you post some additional detail there may be other approaches that aren't quite as brute-force.

share|improve this answer
Thanks for the suggestion, I haven't heard about interface tracking before this but definitely seems like something to look into. – R.K Jul 31 '12 at 14:21
I'll try to post a few more details; to get BPDU packets to traverse the network from one site to another I have set up a pseudo-wire between loop-back interfaces on the 2911s and 881s. The WAN side links are also encrypted with IPSec policies to keep communication secure. The two switches are HP procurves, a 5406 and a 5412. Both are running MSTP in the same MST region. The 5412 has a lower priority to become the root, link between 2911's also has lower priority. Not sure what else what will be useful but if there's anything else that would help let me know and I'll try to post that – R.K Jul 31 '12 at 14:48
Out of curiosity - how do you have the bridge statement set on the routers, or are you just relying on transparently carrying the BPDU's? – rnxrx Jul 31 '12 at 15:33
Just relying on transparently carrying BPDU's – R.K Aug 10 '12 at 18:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.