Redesigning a Collapsed-Access Campus Ring
A regional hospital campus has three buildings connected in a Layer 2 triangle over 10 Gbps single-mode fiber. Each building has a stack of access switches uplinked to a single distribution switch; the three distribution switches run RSTP with default timers. A fiber cut between Buildings A and B two weeks ago caused a 47-second outage; staff reported that the network did not recover until a technician manually bounced a port. Monitoring shows broadcast traffic at 1.8 percent of link capacity at peak, and the spanning-tree topology has been stable since. The CIO wants sub-second convergence and has approved a budget for new optics but not for new chassis. A vendor proposes replacing the triangle with a routed core using OSPF, keeping the existing distribution switches as Layer 3 boundaries with /31 point-to-point links.
1. Evaluate whether the proposed routed-core design addresses the observed failure mode better than tuning RSTP. Justify with convergence mechanics.
Read the worked answer
The 47-second outage is consistent with RSTP relying on indirect failure detection when the physical link does not signal down (e.g., unidirectional fiber or a failed optic that keeps carrier). RSTP's fast proposal/agreement mechanism only converges quickly on edge or explicitly negotiated links; a silently failed uplink waits for the max-age timer (20s default) plus listening/learning states before reconverging.
Tuning RSTP (lower max-age, faster hellos) shrinks but does not eliminate the root cause: Layer 2 has no reliable liveness protocol equivalent to a routing hello. A routed core with OSPF point-to-point links gives each distribution switch an explicit neighbor relationship with dead-interval detection (default 40s, tunable to sub-second with BFD). On link failure, OSPF floods a new LSA and each router recomputes locally; equal-cost paths reconverge in hundreds of milliseconds with BFD.
Caveat: the design must also eliminate the Layer 2 triangle. If any bridging domain still spans buildings, RSTP remains in the path and the original failure mode persists. The recommendation is sound only if each building becomes a distinct Layer 3 domain and inter-building traffic is routed.
2. The vendor claims the routed design removes the need for spanning tree entirely. Assess this claim for the access layer.
Read the worked answer
The claim is overstated. Routing removes the need for spanning tree between buildings, but the access layer still has loops to prevent: dual-homed hosts, unmanaged switches plugged into wall ports, and switch stacks with redundant member links. Unless every access port is configured as an edge port with BPDU Guard and root guard on the distribution-facing ports, a misconfigured downstream device can create a loop that RSTP must block.
A defensible position: keep RSTP enabled but confine it to the access layer, with BPDU Guard on all user ports and Loop Guard on distribution uplinks to catch unidirectional failures. The routed core handles inter-building resilience; RSTP handles intra-building edge protection. Removing STP entirely would be reckless without full port-security discipline.
Also note operational cost: the routed design requires IP address planning per building, OSPF area design, and new troubleshooting skills. The budget covers optics but not training, so include a knowledge-transfer line item.
3. Identify two residual risks after the migration and a mitigation for each.
Read the worked answer
Risk 1: Asymmetric routing during partial failures. With OSPF equal-cost paths, return traffic may take a different building path than forward traffic, breaking stateful firewalls or NAT at the campus edge. Mitigation: place stateful inspection at a single choke point or use OSPF cost tuning to enforce symmetric paths; verify with traceroute in both directions during failover drills.
Risk 2: Micro-loops during reconvergence. OSPF can create transient forwarding loops between the failure and full convergence, causing brief packet loss and, in worst cases, control-plane overload. Mitigation: enable OSPF LSA throttling and SPF throttling, deploy BFD for fast detection, and consider fast-reroute (LFA) where the topology supports it. Test with controlled link flaps and measure loss duration against the sub-second target.