ACI External Switch STP Link Type Configuration

300-620 By islever Editorial Last updated

Implement Layer 2 connectivity (STP/MCP basics and EPG port bindings)

Short answer

D Configure the external switch interfaces facing the ACI fabric with STP type link shared to prevent microloops and CPU spikes.

Question

As part of a migration, legacy non-ACI switches must be connected to the Cisco ACI fabric. All non-ACI switches run per-VLAN RSTP. After the non-ACI switches are connected to Cisco ACI, the STP convergence caused a microloop and significant CPU spike on all switches. Which configuration on the interfaces of the external switches that face the Cisco ACI fabric resolves the problem?
  1. BPDU guard
  2. aggressive STP timers
  3. BPDU filtering
  4. STP type link shared Correct Answer

Key Takeaways

The exam tests knowledge of RSTP compatibility with ACI; the common trap is assuming standard P2P settings apply, whereas 'link-type shared' is required for legacy multi-switch topologies.

This question addresses the configuration of external non-ACI switches connecting to the Cisco ACI fabric, specifically focusing on resolving STP microloops and CPU spikes by setting the correct link type.

Common mistake: Candidates often select BPDU filtering (C) or guard (A), mistakenly believing that blocking BPDUs entirely prevents loops, which can lead to blackholing traffic or err-disabled ports in this context.

Expert Analysis

Why the Answer Is Correct

Correct answer: D — The interfaces on the external switches facing the ACI fabric must be configured with 'STP type link shared'. Cisco ACI leaf switches operate as a single logical spanning-tree root for the attached domain. When connecting to legacy switches that may have multiple paths or redundant links among themselves, the link type must be set to 'shared' so that RSTP does not assume a simple point-to-point topology. This prevents the aggressive transition times of point-to-point links from causing instability, microloops, and CPU spikes during convergence.

Why the Other Options Are Wrong

BPDU guard (A) would shut down the port if a BPDU is received, which is inappropriate since the external switch must participate in the spanning tree. BPDU filtering (C) stops the exchange of BPDUs, effectively removing STP protection and risking severe Layer 2 loops. Aggressive STP timers (B) would exacerbate the issue by speeding up transitions before the topology is stable, likely increasing CPU load rather than resolving it.

Community Comment Notes

Community consensus strongly favors option D, with users citing Cisco documentation that explicitly recommends 'link-type shared' for RSTP connections to ACI. One user noted that while shared links are generally discouraged in pure traditional networks due to timer revert issues, they are the necessary best practice here to ensure compatibility with the ACI fabric's operation. Another comment highlighted that point-to-point is reserved for MST or direct single-link connections, making it incorrect for this multi-switch legacy scenario.

Exam Strategy

When connecting non-ACI devices to ACI, always check the STP protocol version. If using RSTP, configure the external interface as 'link-type shared'; if using MST, use 'point-to-point'. Memorizing this distinction prevents confusion regarding loop prevention mechanisms.

Frequently Asked Questions

Why not use BPDU filtering to stop STP interactions?

BPDU filtering disables STP on the port, which removes loop protection. In an ACI environment, this can lead to broadcast storms and network blackholing because the fabric relies on STP awareness.

When should I use point-to-point vs shared link type?

Use 'point-to-point' when connecting to a single device running MST or when you are certain there is only one path. Use 'shared' when connecting to legacy switches running RSTP that may have internal redundancy or multiple connections.

More 300-620 FAQ →

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Mr_Certifiable 👍 2 Answered D
    Operation The L2 interface connected to ACI leafs should be configured with link-type shared, not point-to-point (P2P). Spanning Tree Protocol (STP) assumes that when the link type is P2P, there will be only one other STP device connected on that interface. https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/application-policy-infrastructure-controller-apic/211236-ACI-operation-with-L2-switches-and-Spann.html
  2. prospio971 👍 2 Answered C
    Enabling BPDU filtering on the interfaces of the legacy non-ACI switches facing the ACI fabric prevents unwanted STP interactions, stabilizes the network, and resolves the issue of microloops and CPU spikes. STP type link shared: This configuration applies to switches that need to participate in shared STP domains, which is not recommended here as it can still lead to loops and microloops.
  3. Rollizo 👍 1 Answered D
    "Ideally you should not have any shared links as this means RSTP would need to revert to STP timers. RSTP and MST are the types of STP now generally used." https://community.cisco.com/t5/switching/spanning-tree-link-type-options/td-p/1690306
  4. MhmdApple 👍 1 Answered C
    It should be C, as the question states that the configuration needs to be done on the non ACI external switches. And it ensures the port won’t go err-disabled as if the BPDU Guard was configured.
  5. chad0128 👍 1 Answered D
    Going with D. Cisco best practice recommendation when connecting non-ACI switches to the farbic is link-type shared for RSTP and link-type P2P for MST.
Show 1 more comment
  1. 959836c 👍 1 Answered D
    D - for sure

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cisco ACI L2Out Loop-Free Topology Actions

S-grade

Configuring In-Band Management in Cisco ACI

S-grade

ACI Management and Data Plane Separation

S-grade

ACI Host Tracking ARP Request Count

S-grade

← Back to 300-620 Study Guide