NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Two Active Switches With Redundant Uplink
Hi, I am looking to connect both switches to my Firewalla each on port one. I am also looking to create a LAG between the two switches on the sfp ports. I am using the default vlan to assign ip add...
No, the switches are not L3, but port 2 on the FW is connected to one switch and port 3 to the other switch. The switches are connected via SFP. The traffic from the FW is Trunk VLAN 2 & 3. The SFP link is also Trunk 2 & 3. I would think that MSTP could prevent loops?
To answer my own question:
I did not need to enable MSTP since each switch is 1 hop from the router. What I needed to do is under, Switching => STP, enable the option for "Forward BPDU while STP Disabled" and disable "Spanning Tree State". This allows the router to receive the packets that it is sending out and properly map out the network.
Josh_Manton wrote:
I did not need to enable MSTP since each switch is 1 hop from the router.
Wild guess: These two router ports which are supposed to seamless connect both switches, providing a single STP environment, or for the allows to run two MSTP entities are mainly L3 router ports, without much L2 support - or the L2 STP/MSTP config on your router requires a review.
Josh_Manton wrote:
What I needed to do is under, Switching => STP, enable the option for "Forward BPDU while STP Disabled" and disable "Spanning Tree State". This allows the router to receive the packets that it is sending out and properly map out the network.
With al due respect, this reads like a hack, not a solution.
- No offense taken. It is possible that keeping STP on is fine, but not MSTP because the firewall (firewalla) only supports standard STP which is probably RSTP. It does not support MSTP. Since I don’t have an actual tree, more of a circle, I don’t think I need to enable STP on the switches. What do you think? The two firewall ports are each multi-honed, 2 subnets separated by vlans. Each subnet has STP enabled.
Does this still sound like a hack?Much easier would be to configure firewalla with multiple ports bridged into a single LAN, and connect these physical ports to one of the switches each.
For this purpose, STP must be enabled on the firewalla on these single LAN for the two bridged ports. This would not make redundancy, but allow two dedicated uplink ports connected to the firewall.
As you have just one active firewall, I'm a little bit lost on how you expect to configure a redundant network. Sure, you could make up a loop and interconnect the two switches direct, permitting you have at lest STP, better some more advanced RSTP to avoid these long recovery times - however, this firewall does not seem to support RSTP.
As STP failover does take 20..30 seconds or more, its not uncommon your network would be blocked fr about 25 seconds following an STP change. https://help.firewalla.com/hc/en-us/articles/14486004537235-Device-is-slow-to-get-an-IP-address-Spanning-Tree-Protocol-STP-
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
