Description

The following KB provides a scenario for troubleshooting PVID or Type Inconsistent blocked or broken (BKN) ports on Cisco catalyst switches running PVST+ when connected to EX switches. 

Symptoms

When I connect my cisco catalyst switch running PVST+ to the EX switch the port goes into blocking mode and shows broken state (BKN).  Logs show PVID or type inconsistent errors.

Solution

When adding Cisco PVST+ switches to standards based switches like the EX switch or to a dot1d cloud, make sure that all switches are connected using dot1q trunks and have consistent native vlan going into the dot1d cloud. This is necessary for situations where loops can arise since Cisco uses the VLAN-ID in PVST+ BPDUs to determine if such a situation exists, and if so, puts the port in a broken state.

There can be scenarios where we cannot dictate the above rule.  For example, an ISP running MSTP on an aggregator EX switch that connects client switches, which can be catalyst Cisco switches running PVST+, connect on a single access vlan to the ISP switchport.  There are chances that PVST+ BPDUs tunnled or flooded by the EX switch will put the customer switchport into PVID inconsistent BKN state.  To avoid this problem, we can set family ethernet-switching type firewall filter to prevent frames with the SSTP or PVST destination mac address 01:00:0c:cc:cc:cd from going out to any such client switches.  This can be applied on ports or VLANs as needed.

NOTE: To understand more about the Cisco implementation please refer to the following Cisco documentation, "Troubleshooting Spanning Tree PVID- and Type-Inconsistencies":
www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00801d11a0.shtml