Skip to content

Spanning tree across the front ports, 2026-11-02

969: an XGS 3100's owner, setting the appliance up after its first boot, met loops. The first boot puts every front port but WAN into one bridge, bridge0, which is LAN, and makes it without spanning tree (scripts/xgs/assign.php): two of those ports in one network are a loop through the appliance. Does RSTP work across these ports at all - does a bridge's BPDU cross a front port both ways, through the coprocessor and, on a copper port, its switch?

Measured on the lab's two XGS 3300s (vendor versions 23 and 22, the OCTEON TX family) and its XGS 136 (vendor version 21, the ARMADA family), with bridges made at run time - ifconfig bridgeN addm <port> stp <port> and proto rstp, which is what OPNsense runs for a bridge's "Spanning Tree Protocol (RSTP/STP)" options - and destroyed after; nothing was written to a configuration (images/deploy/lab-rstp.sh).

Spanning tree across the front ports, 19:47:55 UTC: three links, each with a one-member RSTP bridge at both ends - after 12 s one end of each sees the other as root, its port root forwarding, the root's port designated forwarding; then F1 and F2 of the first XGS 3300 and A4 and A2 of the second in one bridge each, a loop - within 3 s the second's A2 alternate discarding, and over 10 s five packets out of each of the first's two ports and none in; the links answering afterwards

A BPDU, one link at a time. A bridge of one member at each end of three links. After 12 s each pair had one root: one end saw the other's bridge as its root, its port root forwarding, and the root's port was designated forwarding. That shows the root's BPDU crossing; it does not show the other way, since a port that hears no BPDU at all also forwards, as an edge port. So the same was asked again with each end made the root once - below. The links:

  • the first XGS 3300's F1 (oxp0, one of its coprocessor's own SerDes ports) and the second's A4 (oxp12, a port of its expansion module);
  • the first XGS 3300's F2 (oxp1) and the second's A2 (oxp14);
  • the second XGS 3300's Port8 (oxp9, a copper port behind its switch) and the XGS 136's Port8 (npup8, behind its own).

A loop. Then F1 and F2 in one bridge on the first XGS 3300, and A4 and A2 in one on the second: two 10G links between the two appliances, bridged at both ends. Within 3 s RSTP had made the first XGS 3300 the root and put the second's A2 in alternate discarding, A4 forwarding - and the same at 35 s. Over the next 10 s each of the first XGS 3300's two ports sent five packets, the root's BPDU every two seconds, and received none: no storm. Each link answered afterwards.

This is the second of two runs (19:46 and 19:47 UTC), the first photographed in a window too short for its first lines. In this one the XGS 136 did not answer the PC at the look 20 s in and at the end - the bench's own link to it, as on 2026-10-27 - so its line at 20 s is missing, and its test bridge was destroyed by hand at 19:49:27. The first run had every line, with the same roots, roles and states, and the same quiet loop.

Each end the root once. Then the same at 20:08 UTC, every link and the loop asked twice: once as above, once with the second XGS 3300's bridges given priority 4096, which made them the root. Each end then saw the other as its root in turn - the first XGS 3300 through F1 and F2, the XGS 136 through the second XGS 3300's Port8 - and no member's flags had EDGE, which a port that heard no BPDU takes. In the loop, whichever appliance was not the root blocked one of its two ports: the second's A2 with the first the root, the first's F2 with the second the root, each alternate discarding within 4 s, and the root's ports sending their BPDUs and receiving nothing over the next 10 s.

Each end the root once, 20:08:33 UTC: the three links with default priorities, then with the second XGS 3300's bridges at priority 4096 - each end seeing the other as root in turn, no member flagged EDGE; the loop with the first XGS 3300 the root, the second's A2 alternate discarding, and with the second the root, the first's F2 alternate discarding; the root's ports quiet, the links answering afterwards

So the BPDUs cross every one of these links both ways, and a bridge of these ports with RSTP on its members blocks a second cable into one network instead of looping. The bridge the first boot makes does not have it yet.

Not measured: a loop through two copper ports of one appliance (no free pair was cabled), and an XGS 3100 itself.

Discussion

The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.