Skip to content
Log in Sign up My account

2.2 Campus Layer 2 Infrastructure

Blueprint 2.2: Campus Layer 2 infrastructure

  • 2.2.a STP scalability
  • 2.2.b Fast convergence
  • 2.2.c Loop-free technologies
  • 2.2.d PoE and WoL
  • 2.2.e Layer 2 security (STP security, port security, VACL)

The ENCOR pages teach how RSTP, MST, EtherChannel and the STP guards work. ENSLD asks when to keep Layer 2 at all, how large a spanning tree domain can safely get, and which protection belongs on which port. For mechanics see RSTP, MST, EtherChannel and STP protection features.

The central design question: how far does a VLAN go?

Every Layer 2 problem gets bigger with the size of the broadcast and spanning tree domain. The first design decision is therefore the Layer 2 boundary.

Option Layer 2 reaches Strengths Weaknesses
Routed access Only inside one access switch or stack No STP blocking, no FHRP, ECMP and fast convergence, small failure domains VLANs cannot span closets, so wireless roaming and mobility across closets need an overlay or a design change
Layer 2 access, VLANs local to a distribution pair One building block Familiar, simple VLAN-per-closet-group STP is still in play, FHRP is needed
Layer 2 access, VLANs spanning many blocks Whole campus Flexible VLAN placement Large failure domain, a loop or broadcast storm hits everywhere. Avoid
Overlay (SD-Access) Logical Layer 2 over a routed underlay Subnets anywhere without STP across the campus Needs the fabric platform and licensing, see 2.4

The rule of thumb for the exam: keep Layer 2 small and local, use Layer 3 between blocks, and use an overlay when you need a subnet to appear in many places.

2.2.a STP scalability

Spanning tree runs per VLAN (PVST+, Rapid PVST+) or per instance (MST). The number of spanning tree instances multiplied by the ports in each is a load on the control plane.

Rapid PVST+ MST
Instances One per VLAN A few instances, VLANs mapped to them
CPU and memory Grows with VLANs times trunk ports Stays low, scales to many VLANs
Per-VLAN load sharing Natural, root per VLAN Per instance, so plan the mapping
Config discipline Light Name, revision and VLAN-to-instance map must match in a region, a mismatch splits the region
Interoperability Cisco-centric (works with RSTP elsewhere via the CST) IEEE 802.1s, multivendor
Choose when Moderate VLAN count, Cisco-only, simplicity matters Large VLAN counts, multivendor, or platform limits on logical ports are a concern

Scalability levers, in order of impact:

  1. Reduce the domain. Prune VLANs from trunks that do not need them, keep VLANs local, and use routed links between blocks.
  2. Choose the right mode. Rapid PVST+ for modest scale, MST for hundreds of VLANs or multivendor.
  3. Pick roots deliberately. Set the primary and secondary root by priority on the distribution switches, never leave it to the lowest MAC.
  4. Bound the diameter. The default STP diameter assumption is seven bridges. Large diameters hurt convergence on legacy timers and the maximum age.
  5. Keep the topology simple. Triangles from access to a distribution pair, not rings of access switches.
graph TB
  R1["Dist 1<br/>root VLANs 10-19<br/>secondary 20-29"] --- R2["Dist 2<br/>root VLANs 20-29<br/>secondary 10-19"]
  A1["Access 1"] --- R1
  A1 --- R2
  A2["Access 2"] --- R1
  A2 --- R2

Exam trap

MST does not make STP faster. It makes it lighter on the control plane when there are many VLANs. A mismatched MST configuration name, revision or VLAN mapping makes a switch a separate region, which shows up as a suboptimal tree or blocked ports at the region boundary, not as an obvious error.

2.2.b Fast convergence

Classic 802.1D takes 30 to 50 seconds to bring a port forward. Fast convergence is a combination of the right protocol and removing the waits.

Technique Role
Rapid PVST+ or MST (both RSTP-based) Proposal and agreement handshake on point-to-point links, so a new root port goes forward in a short time without waiting on timers
PortFast (edge ports) Edge ports go forward immediately and never trigger topology change handling. Required on every host port
Point-to-point links RSTP fast transition needs full-duplex links. A shared or half-duplex link falls back to timers
UplinkFast and BackboneFast Needed with legacy PVST+. Built into RSTP behaviour, so they are not needed with Rapid PVST+ or MST
EtherChannel A link failure inside a bundle does not change the tree
Routed access or virtual switch Removes the blocked link from the equation
Flex Links, REP Link-pair or ring protocols that bypass STP in specific places

Fast convergence also depends on the FHRP and the routing protocol above the Layer 2 layer. A fast STP recovery in a Layer 2 access design still waits for HSRP timers if the active gateway failed. Consider the whole chain: Layer 1 detection, STP, FHRP, routing.

spanning-tree mode rapid-pvst
spanning-tree vlan 10-19 root primary
spanning-tree vlan 20-29 root secondary
!
interface range GigabitEthernet1/0/1 - 24
 spanning-tree portfast
 spanning-tree bpduguard enable

2.2.c Loop-free technologies

The best loop protection is a topology that cannot loop. Several technologies remove the dependency on STP or limit its role.

Technology How it avoids blocked links or loops Where it fits
Routed access No Layer 2 between closets and distribution New builds, high availability focus
Multichassis EtherChannel (StackWise Virtual, VSS) Two chassis appear as one, so the access switch sees a single bundle with no loop Distribution and core
Stacking Several switches act as one logical switch, with cross-member EtherChannel Access closets
EtherChannel (LACP) Bundles parallel links into one logical link Any parallel links
Flex Links A pair of uplinks, one active and one in standby, no STP on the pair Simple access with two uplinks, service-provider style
REP Ring protocol with fast convergence for access rings Industrial and ring topologies
Overlay fabric Subnets over a routed underlay, no campus-wide Layer 2 SD-Access

Loop-free designs at the distribution layer fall into two shapes. In a loop-free U design a VLAN exists on one access switch pair and the distribution pair, and the distribution-to-distribution link is routed. STP has no loop to block. In a looped triangle design the VLAN spans both distribution switches and the link between them, so STP blocks one path. Choose looped triangle only when a VLAN really must cross both distributions.

Exam trap

A virtual switch pair removes blocked uplinks between access and distribution, but STP must still be enabled everywhere as a safety net. Loop-free design does not mean turning STP off. Keep Rapid PVST+ or MST, PortFast and BPDU Guard on edge ports, and Loop Guard or UDLD where a unidirectional fault would otherwise create a loop.

2.2.d PoE and WoL

Power over Ethernet

Standard Common name Power at the switch port Typical devices
IEEE 802.3af PoE 15.4 W Phones, basic APs
IEEE 802.3at PoE+ 30 W Wi-Fi APs, cameras
IEEE 802.3bt Type 3 4-pair PoE 60 W Multi-radio APs, thin clients
IEEE 802.3bt Type 4 4-pair PoE 90 W PTZ cameras, displays
Cisco UPOE and UPOE+ Cisco-defined 60 W and 90 W Same classes, Cisco devices

Design points:

  • Budget the switch, not just the port. Add up the worst-case draw of all ports and compare it with the power supply capacity, with N+1 redundancy so a failed supply does not drop PoE ports.
  • Class versus actual power. Devices can negotiate with CDP or LLDP-MED to request less than the class maximum, which stretches the budget.
  • Keep power during reloads. Perpetual PoE and fast PoE keep phones and APs powered through a switch reload, which avoids a long reboot of every endpoint.
  • Cabling. Use cable suitable for high-power bundles for the 60 W and 90 W classes, since heating in dense bundles matters.

Wake-on-LAN

WoL wakes a sleeping host with a magic packet sent to its MAC address, normally as a Layer 2 broadcast. Design consequences:

  • A magic packet does not cross a router by default. In routed access or a different subnet, you need a directed broadcast (ip directed-broadcast with a controlling ACL) or a management system that sends the packet from inside the target subnet.
  • With 802.1X a sleeping host's port is unauthenticated, so the magic packet is blocked. Set authentication control-direction in so inbound traffic is allowed on an unauthorized port while outbound is blocked.

2.2.e Layer 2 security

STP security

Feature Protects against
BPDU Guard on edge ports A switch or loop appearing on a host port. Error-disables the port
BPDU Filter Suppresses BPDUs. Dangerous, because it hides loops. Use rarely
Root Guard on ports facing downstream Another switch claiming root, for example a rogue switch or a misconfigured access switch
Loop Guard on non-designated ports A port that stops receiving BPDUs and would otherwise start forwarding
UDLD Unidirectional fibre links

Port security and other access controls

  • Port security limits the number of MAC addresses on an access port and chooses the violation action: shutdown (error-disable), restrict (drop and log) or protect (drop silently). It stops MAC flooding and unauthorised devices but does not authenticate users.
  • DHCP snooping, Dynamic ARP Inspection and IP Source Guard protect against rogue DHCP servers, ARP spoofing and address spoofing. They share the DHCP snooping binding table.
  • Private VLANs isolate hosts inside one subnet, for example in guest or server segments.
  • IEEE 802.1X (see the security pages) authenticates the endpoint and can assign a VLAN or SGT. It is the stronger control compared with port security alone.

VACLs

A VLAN ACL filters traffic inside a VLAN, both bridged (same VLAN) and routed (into or out of the VLAN). Unlike a router ACL, which applies at an interface in a direction, the VACL applies to all traffic in the VLAN and has no direction.

ip access-list extended TELNET-TRAFFIC
 permit tcp any any eq 23
!
vlan access-map BLOCK-TELNET 10
 match ip address TELNET-TRAFFIC
 action drop
vlan access-map BLOCK-TELNET 20
 action forward
!
vlan filter BLOCK-TELNET vlan-list 20

Use a VACL when hosts in the same VLAN must be restricted from each other, which a routed ACL cannot do, since that traffic never reaches the SVI. The access map needs a final clause that forwards everything else, or the implicit drop blocks all traffic not matched.

Exam trap

Port security is not authentication and it is not an answer to rogue DHCP servers. Match the threat to the control: rogue switch is BPDU Guard or Root Guard, rogue DHCP server is DHCP snooping, intra-VLAN filtering is a VACL or private VLAN, MAC flooding is port security.

Design exercise

Scenario. A university library building has 60 VLANs for departments and shared study areas. Staff want to place any VLAN in any floor closet. Each floor has two access switches. The building has a distribution pair that is Catalyst 9000 chassis. The network team has had two loops from students plugging in small switches, and a rogue DHCP server last term. The AP and phone count will double next year.

Requirements: avoid campus-wide Layer 2, recover from uplink failure in under a second, stop rogue switches and DHCP servers, and handle the added PoE load.

Model answer

Topology: keep VLANs local to the building. Use StackWise Virtual on the distribution pair with multichassis EtherChannel to each access stack, so there are no blocked uplinks and STP is a backstop. Keep Rapid PVST+ with 60 VLANs. MST is not necessary at this scale on a Catalyst 9000 platform, though it remains an option if the platform logical-port limit is reached. If staff truly need any VLAN on any floor across several buildings, an SD-Access overlay is the answer rather than extending VLANs.

Convergence: EtherChannel hardware rehash handles most failures. PortFast on all edge ports, BPDU Guard to catch student switches, Root Guard on distribution ports toward access.

Security: DHCP snooping on all user VLANs with trusted uplinks, Dynamic ARP Inspection, and port security or 802.1X for MAC limits. A VACL is not needed for this requirement.

PoE: recalculate the PoE budget for the doubled load, add redundant power supplies or move to 802.3bt-capable access models, and enable perpetual PoE for AP uptime.

Rejected alternatives:

  • Routed access. It would give the best convergence, but it prevents "any VLAN on any floor" without an overlay.
  • Campus-wide trunking of all 60 VLANs. It meets the placement wish but makes one student loop a campus-wide event.
  • BPDU Filter on edge ports. It would hide the very student switches the team wants to catch.
  • MST across the building. It adds a region configuration to maintain for no real scaling gain at this size.

Quick check

A new switch is plugged into a PortFast edge port that has BPDU Guard. What happens?

The port receives a BPDU, BPDU Guard puts it in the error-disabled state, and traffic stops. This protects the tree from a rogue switch.

Why does a Wake-on-LAN magic packet fail between two routed access VLANs?

The magic packet is a Layer 2 broadcast and a router does not forward it. A directed broadcast (with an ACL) or a sender inside the target subnet is needed.

When is MST preferable to Rapid PVST+?

When there are many VLANs and the per-VLAN instance load is a concern, or when the network includes non-Cisco switches that run IEEE 802.1s.

References

  • Cisco Campus LAN and Wireless LAN Solution Design Guide (CVD): search on cisco.com
  • Cisco Catalyst 9000 series configuration guides for Layer 2, PoE and security: search the platform name on cisco.com
  • IEEE 802.1w, 802.1s, 802.3af, 802.3at and 802.3bt are the underlying standards
  • Cisco Live On-Demand Library: search "campus Layer 2 design" and "spanning tree best practices"