采用1台路由器和4台交换机组成MSTP域，在SW1 和SW2上启用VRRP，多个PC组成，拓扑如下：
基本配置
SW1
vlan 10 20
配置 MST 域（全网必须一致）
stp region-configuration
region-name MSTP-DOMAIN
revision-level 1
instance 10 vlan 10
instance 20 vlan 20
active region-configuration
指定实例的根桥优先级（值越小越优先）
stp instance 10 priority 0
stp instance 20 priority 4096
配置互联端口
interface GigabitEthernet1/0/3
description TO_Core-SW2
port link-type trunk
port trunk permit vlan 10 20
interface GigabitEthernet1/0/1
description TO_Access-SW1
port link-type trunk port trunk permit vlan 10 20
interface GigabitEthernet1/0/2
description TO_Access-SW2
port link-type trunk
port trunk permit vlan 10 20
配置 VLAN 接口 IP 及 VRRP
VLAN 10：主网关
interface Vlan 10
ip address 192.168.10.2 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.1 # 虚拟网关
vrrp vrid 10 priority 120 # 优先级高于备设备
vrrp vrid 10 preempt-mode timer delay 10 # 抢占模式，延迟 10 秒
vrrp vrid 10 track 1 priority reduced 30 # 上联口故障时优先级降低 30
track 1 interface GigabitEthernet 1/0/10
interface Vlan 20
ip address 192.168.20.2 255.255.255.0
vrrp vrid 20
virtual-ip 192.168.20.1
SW2
vlan 10 20
配置 MST 域（全网必须一致）
stp region-configuration
region-name MSTP-DOMAIN
revision-level 1
instance 10 vlan 10
instance 20 vlan 20
active region-configuration
指定实例的根桥优先级（值越小越优先）
stp instance 10 priority 4096
stp instance 20 priority 0
配置互联端口
interface GigabitEthernet1/0/3
description TO_Core-SW1
port link-type trunk
port trunk permit vlan 10 20
interface GigabitEthernet1/0/1
description TO_Access-SW1
port link-type trunk
port trunk permit vlan 10 20
interface GigabitEthernet1/0/2
description TO_Access-SW2
port link-type trunk
port trunk permit vlan 10 20
配置 VLAN 接口 IP 及 VRRP
VLAN 10：主网关
interface Vlan 10
ip address 192.168.10.3 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.1 # 虚拟网关
track 1 interface GigabitEthernet 1/0/10
interface Vlan 20
ip address 192.168.20.3 255.255.255.0
vrrp vrid 20 virtual-ip 192.168.20.1
vrrp vrid 20 priority 120 # 优先级高于备设备
vrrp vrid 20 preempt-mode timer delay 10 # 抢占模式，延迟 10 秒
vrrp vrid 20 track 1 priority reduced 30 # 上联口故障时优先级降低 30
SW3
vlan 10 20
配置 MST 域（全网必须一致）
stp region-configuration
region-name MSTP-DOMAIN
revision-level 1
instance 10 vlan 10
instance 20 vlan 20
active region-configuration
interface GigabitEthernet1/0/1
description TO_core-SW1
port link-type trunk
port trunk permit vlan 10 20
interface GigabitEthernet1/0/2
description TO_core-SW2
port link-type trunk
port trunk permit vlan 10 20
interface GigabitEthernet1/0/10
port link-type access
port access vlan 10
interface GigabitEthernet1/0/11
port link-type access
port access vlan 20
SW4
vlan 10 20
配置 MST 域（全网必须一致）
stp region-configuration
region-name MSTP-DOMAIN
revision-level 1
instance 10 vlan 10
instance 20 vlan 20
active region-configuration
interface GigabitEthernet1/0/1
description TO_core-SW1
port link-type trunk
port trunk permit vlan 10 20
interface GigabitEthernet1/0/2
description TO_core-SW2
port link-type trunk
port trunk permit vlan 10 20
interface GigabitEthernet1/0/10
port link-type access
port access vlan 10
interface GigabitEthernet1/0/11
port link-type access
port access vlan 20
查看MSTP状态
SW1
SW2
SW3
SW4
通过上图能看到两个实例都在最优的路径上，实现流量的负载均衡，最终效果如下图所示：
当SW3与CORE1互联链路down掉时，VLAN10的流量会从SW3与CORE2的互联链路通过，
当SW4与CORE2互联链路down掉时，VLAN20的流量会从SW4与CORE1的互联链路通过，
保障了业务的稳定性。通过VRRP网关主备，保障了网关的高可用。
进阶配置
配置对外互联，使用R1模拟公网
SW1
int lo0
ip add 1.1.1.1 255.255.255.255
int gi 1/0/10
port link-mode route
y
ip add 10.0.17.2 255.255.255.0
ospf 1
router-id 1.1.1.1
area 0
network 192.168.10.0 0.0.0.255
network 192.168.20.0 0.0.0.255
network 10.0.17.0 0.0.0.255
SW2
int lo0
ip add 2.2.2.2 255.255.255.255
int gi 1/0/10
port link-mode route
y
ip add 10.0.27.2 255.255.255.0
ospf 1
router-id 2.2.2.2
area 0
network 192.168.10.0 0.0.0.255
network 192.168.20.0 0.0.0.255
network 10.0.27.0 0.0.0.255
R1
int lo0
ip add 7.7.7.7 255.255.255.255
int gi 0/0/1
ip add 10.0.17.1 255.255.255.0
int gi 0/0/2
ip add 10.0.27.1 255.255.255.0
ospf 1
router-id 7.7.7.7
area 0
network 7.7.7.7 0.0.0.0
network 10.0.17.0 0.0.0.255
network 10.0.27.0 0.0.0.255
查看ospf邻居状态
R1
SW1
SW2
使用pc5 ping 测试公网IP 7.7.7.7 ，然后手动关闭SW1与SW3的互联链路，查看ping是否有丢包
ping 测试影响，使用pc5 ping 测试公网IP 7.7.7.7 ，然后手动关闭SW1与R1的互联链路，查看ping是否有丢包
关闭上联接口后，OSPF邻居发生变化 ，VRRP主备状态发生变化，但ping测没有丢包。
此时，7.7.7.7的路由从CORE2学习到，路径从SW3-CORE1-R1，切换到SW3-CORE2-R1。有效保障了业务稳定性，在实际环境中，可能会1-2个丢包，都是正常现象。
总结： 采用MSTP+VRRP方案，花钱买两台核心，绝不让一半端口闲置吃灰；通过多生成树的负载均衡，一台的钱干两台的活，资产回报直接翻倍。故障切换不到一秒，业务零感知，运营中断成本归零。路径天然合一，再无次优绕行，带宽不浪费，延时就可控。标准协议不受厂商绑架，现有投资全保护，未来升级无风险。一句话：用确定性拓扑，把可靠性变成了印钞机，而不只是买保险。