Hi Mburu,<br><br>Looks like you have plenty to go with, but I may add a thing or two which you may already know.<br><br><ul><li>STP is not necessarily evil if the network is well designed and managed. I concur with Gitau on the &#39;balancing&#39; act on HSRP, but if your 6513 supervisor engines have VSS then forget the HSRP.</li>
<li>60 vlans are not many, and you will most likely never revisit when you complete the project. For the hardware you are running you will not feel 1micro second at the user end. use the STP commands like bpduguard, root guard, portfast at the appropriate locations, but true VTP can end up in tears, and not from users but network admins themselves.<br>
</li><li>Aki advices to segment the network. Please do this in the beginning rather than later, using L3 or L2/L3 devices. The 6513 can assist do this for you based on the modules you have [is there a datacentre LAN involved?]</li>
<li>Am not sure what business, the said corporate is in but how you design and implement will determine how easily you will implement other solutions, general security features/policies/solutions and QOS like DHCP Snooping ARP inspections to comply to some international standards like PCI-DSS.</li>
<li>For good input into your process, requirements/architectures would help if you will not be breaching any confidentiality. else feel free to contact us off the list.<br></li></ul>Cheers,<br><br>Stan Ngure<br><br><div class="gmail_quote">
On Mon, Feb 27, 2012 at 1:50 PM, John Gitau <span dir="ltr">&lt;<a href="mailto:jgitau@gmail.com">jgitau@gmail.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF"><div>Well all my VTP stories end in tears. Most STP stories tend to end there too. Sigh...oh! well if it works it works right?:-)<br><br>Sent from my iPad</div><div><br>On 27 Feb 2012, at 12:46, jim ndegwa &lt;<a href="mailto:ndegwajim@yahoo.com" target="_blank">ndegwajim@yahoo.com</a>&gt; wrote:<br>
<br></div><div></div><blockquote type="cite"><div><div style="font-size:10pt;font-family:times new roman,new york,times,serif"><div><span>my experience with vtp on a large govt deployment was excellent (lots of access switches and two 6509 Core). Proper documentation does help of course. Challenge is that we techies dislike write-ups after project completion<br>
</span></div><div><br></div>  <div style="font-family:times new roman,new york,times,serif;font-size:10pt"> <div style="font-family:times new roman,new york,times,serif;font-size:12pt"> <div dir="ltr"> <font face="Arial"> <hr size="1">
  <b><span style="font-weight:bold">From:</span></b> Mark Tinka &lt;<a href="mailto:mtinka@globaltransit.net" target="_blank">mtinka@globaltransit.net</a>&gt;<br> <b><span style="font-weight:bold">To:</span></b> <a href="mailto:eanog@lists.my.co.ke" target="_blank">eanog@lists.my.co.ke</a> <br>
<b><span style="font-weight:bold">Cc:</span></b> John Gitau &lt;<a href="mailto:jgitau@gmail.com" target="_blank">jgitau@gmail.com</a>&gt;; jim ndegwa &lt;<a href="mailto:ndegwajim@yahoo.com" target="_blank">ndegwajim@yahoo.com</a>&gt;; SkunkworksMailing List
 &lt;<a href="mailto:skunkworks@lists.my.co.ke" target="_blank">skunkworks@lists.my.co.ke</a>&gt; <br> <b><span style="font-weight:bold">Sent:</span></b> Monday, February 27, 2012 11:34 AM<div class="im"><br> <b><span style="font-weight:bold">Subject:</span></b> Re: [EANOG] [Skunkworks]  STP convergence &amp; MST<br>
 </div></font> </div><div class="im"> <br>
On Monday, February 27, 2012 03:51:15 PM John Gitau wrote:<br><br>&gt; -Disable vtp. Prune manually. 60 is not a large number.<br>&gt; Just for comparison for one segment of our network we<br>&gt; have well over 7000 Vlans and yes stp/vtp are disabled.<br>
&gt; We planned it that way.<br><br></div>Sage advice.<br><br>VTP is evil.<div class="im"><br><br>&gt; -Even if you choose to go L3 end<br>&gt; to end. I wouldn&#39;t advocate for a total stp shutdown as<br>&gt; has been advised unless you are very sure no one can<br>
&gt; attach a random switch or other bpdu generating device.<br>&gt; You can start planning the transition though.<br><br></div>If STP is mainly used core-facing, I&#39;d suggest disabling it <br>there, for those who are running an IP/MPLS Access and <br>
Aggregation network.<br><br>Of course, continuining to have STP and/or BPDU filtering on <br>customer-facing ports is highly advised. <br><br>We block Edge ports that receive BPDU&#39;s, and we&#39;ve been <br>happy. Pain of one
 customer is better than pain of many :-).<br><br>Mark.<br><br><br> </div> </div>  </div></div></blockquote></div><br>_______________________________________________<br>
Skunkworks mailing list<br>
<a href="mailto:Skunkworks@lists.my.co.ke">Skunkworks@lists.my.co.ke</a><br>
------------<br>
List info, subscribe/unsubscribe<br>
<a href="http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks" target="_blank">http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks</a><br>
------------<br>
<br>
Skunkworks Rules<br>
<a href="http://my.co.ke/phpbb/viewtopic.php?f=24&amp;t=94" target="_blank">http://my.co.ke/phpbb/viewtopic.php?f=24&amp;t=94</a><br>
------------<br>
Other services @ <a href="http://my.co.ke" target="_blank">http://my.co.ke</a><br></blockquote></div><br><br clear="all"><br>-- <br><div>Kind Regards,<br>_______________________________________________________<br></div><div>
<br>Stan Ngure<br><br></div><br>