Description

This article describes the issue of the Cisco switch's spanning tree being incorrect, when connected to SRX. The customer has configured two separate bridge domains and each one connects to a different VLAN in the Cisco switch.


Symptoms

  The topology is as below:


                                      Cisco switch 1
                         vlan945 |                  | vlan1145
                           reth0 |                  | reth1
                                 SRX3600
                           reth2 |                  | reth1
                         vlan945 |                  | vlan1145
                                     Cisco switch 2

The Cisco switch's interfaces are in access mode.


Here is the SRX configuration:
>show config:
...
reth0 {
     redundant-ether-options {
         redundancy-group 1;
}
unit 0 {
     family bridge {
     interface-mode access;
     vlan-id 945;
     }
}
}
reth1 {
     redundant-ether-options {
     redundancy-group 1;
     }
unit 0 {
    family bridge {
        interface-mode access;
        vlan-id 1145;
    }
}
}
reth2 {
     redundant-ether-options {
         redundancy-group 1;
     }
unit 0 {
     family bridge {
         interface-mode access;
         vlan-id 945;
     }
}
}
reth3 {
     redundant-ether-options {
         redundancy-group 1;
     }
unit 0 {
     family bridge {
         interface-mode access;
         vlan-id 1145;
     }
}
}
}
......
bridge-domains {
     L2-VLAN-1145 {
     vlan-id 1145;
}
L2-VLAN-945 {
     vlan-id 945;
     routing-interface irb.945;
}
}
..
Customer found that the spanning tree was incorrect in the Cisco switch:
TC1-03-CS01#sh spanning-tree vlan 1145

VLAN1145
Spanning tree enabled protocol ieee
Root ID Priority 9137
Address 0011.bcbc.4000 <--- root switch
Cost 2
Port 4 (TenGigabitEthernet1/4)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 9337 (priority 8192 sys-id-ext 1145)
Address 0011.bcbc.4000 <--- local switch is a root switch in vlan 1145
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 480

Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Te1/4 Root FWD 2 128.4 P2p <--- Te1/4 is a root port, this is incorrect as root switch should not have the root port
Po1 Desg FWD 1 128.1665 P2p

Without firewall, cisco switch spanning tree is correct:

TC1-03-CS01#sh spanning-tree vlan 1145

VLAN1145
Spanning tree enabled protocol ieee
Root ID Priority 9337
Address 0011.bcbc.4000
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 9337 (priority 8192 sys-id-ext 1145)
Address 0011.bcbc.4000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 480

Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Te1/4 Desg FWD 2 128.4 P2p
Po1 Desg FWD 1 128.1665 P2p

Solution

 This is an known limitation with bridge-domain. SRX will forward the BPDU to all layer 2 ifs, without changing the packet format; even though there are separate bridge domains. SRX will flood the BPDU from VLAN945 to VLAN1145. This causes the Cisco switch spanning tree error.

 There is an enhancement for BPDU flooding. It is a hidden command to change the SRX L2 BPDU forwarding behavior.

root@srx3600t# show security

flow {
     bridge {
         + bpdu-vlan-flooding;
     }
}

After the hidden command is added, SRX will treat 802.1D BPDU as a regular no IP packet. The BPDU will flood only the VLAN, to which it belongs.

You can check BPDU flooding status in vty mode:
[flowd]FPC7.PIC0(vty)# show usp l2flow config flow
Current L2FLOW configuration:
=============================
Bridge Parameters::
block-non-ip-all : disabled (default)
bypass-non-ip-unicast: disabled (default)
no-packet-flooding : disabled (default)
no-trace-route : disabled (default)
+ bpdu-vlan-flooding : enabled

Translated L2FLOW options:
==========================
block-non-ip-all : disabled (default)
bypass-non-ip-unicast: disabled (default)
broadcast-arp : disabled (default)
broadcast-icmp : disabled (default)