Recurring outages in a community college access network
Valley Community College has three buildings and 1,800 daily users. The core is a pair of 5520 switches; 22 X465 access switches are dual-homed with fiber, but each access switch has only one active uplink because the second port is blocked by spanning tree. The STP root is an access switch in Building B with priority 4096. Every afternoon, when cleaning staff plug in personal switches and a lab adds a daisy-chained unmanaged switch, the network logs MAC flaps and topology changes; VoIP calls drop for 30 to 60 seconds. One building uplink negotiates 1 Gbps while the core port is 10 Gbps. PoE cameras and phones share the same closets, and there is no BPDU guard, root guard, or loop detection enabled. The college wants no more outages before the next semester but cannot recable every closet.
1. What is the most likely reason for the recurring outages, and why does the second uplink stay blocked?
Read the worked answer
The outages are consistent with a user-added unmanaged switch creating a Layer 2 loop. Spanning tree detects the topology change, reconverges, and briefly floods; that explains the MAC flaps, the 30-to-60-second voice outage, and the afternoon pattern when staff and labs connect temporary equipment.
The second uplink stays blocked because the access switch is dual-homed to two core switches without a multi-switch aggregation. From STP's perspective, both uplinks lead to the same Layer 2 domain, so one must be blocked to prevent a loop. The access switch being STP root with priority 4096 makes the problem worse: it attracts topology toward the access layer and increases the scope of every reconvergence. The 1 Gbps negotiation on one building is a separate physical or transceiver issue, but it removes the expected capacity redundancy.
The absence of BPDU guard, root guard, and loop detection means the network has no automatic defense at the edge.
2. Propose a target access-core design using available Extreme features and a prioritized remediation list for the next maintenance window.
Read the worked answer
The target should remove the blocked-uplink design and put protection at the edge.
- Aggregate the core pair: Use MLAG or an equivalent multi-switch aggregation supported by the 5520 pair so both access uplinks can forward as one LACP bundle. If the 5520 pair cannot provide the required MLAG behavior, use a supported stack or a VOSS SMLT pair at the core.
- Fix STP root: Set the core pair to the lowest STP priority so the root is deterministic and in the core. Keep access switches at a higher priority.
- Protect user ports: Apply BPDU guard to edge ports so a rogue switch err-disables the port. Apply root guard on core-facing access ports so an access switch cannot become root. Enable loop detection such as ELRP where supported.
- Control flooding: Apply broadcast and multicast storm control on access ports, disable unused ports, and put them in an unused VLAN.
- Fix the 1 Gbps link: Check optics, cable, and negotiated speed; do not accept a 10G core port running at 1G unless it is intentional.
Prioritize BPDU guard, root priority, and the 1G link in the first window; schedule MLAG and dual-homing changes per building.
3. How would you validate that the changes actually prevent a rogue-switch loop without taking down the campus?
Read the worked answer
Validate in a controlled closet before touching production buildings.
Build a test port with the same access-switch model and configuration. Connect an unmanaged switch in a loop and confirm that BPDU guard err-disables the port and generates an alert; confirm that the rest of the switch remains reachable. Test ELRP or loop detection separately so you know which feature reacts first. Verify that root guard prevents the test access switch from becoming root.
On the production side, enable the features in monitor mode where possible, review logs for a week, then enforce in a maintenance window. Use a single building as a canary. After enforcement, check that dual-homed access switches show both uplinks active, that the core is root, and that no legitimate BPDU is being dropped. Keep console or out-of-band access available for rollback. Success means a rogue switch causes one port to disable and an alert to fire, not a campus-wide reconvergence.