ISL is in blocking state

Symptom

The VSX LAGs are shown as Blocking in the output of the show spanning-tree detail command.

switch# show spanning-tree detail
Spanning tree status : Enabled Protocol: MSTP

MST0
Root ID Priority : 32768
      MAC-Address: 02:02:02:02:02:02
      This bridge is the root
      Hello time (in seconds):2 Max Age (in seconds):20
      Forward Delay (in seconds):15

Bridge ID Priority: 32768
     MAC-Address: 02:02:02:02:02:02
     Hello time (in seconds):2 Max Age (in seconds):20
     Forward Delay (in seconds):15

Port   Role     State    Cost   Priority Type
------ -------- -------- ------ -------- -------
lag1   Disabled Blocking 20000  64       shared
lag100 Disabled Blocking 20000  64       shared

Topology change flag : False
Number of topology changes : 0
Last topology change occurred: 3876 seconds ago
Timers: Hello expiry 0, Forward delay expiry 0

Port lag1 id 321
Designated root has priority : 32768 Address: 02:02:02:02:02:02
Designated bridge has priority : 32768 Address: 02:02:02:02:02:02
Designated port id : 0
Multi-Chassis role : active

Number of transitions to forwarding state: 0
Bpdus sent 0, received 0

Port lag100 id 420
Designated root has priority : 32768 Address: 02:02:02:02:02:02
Designated bridge has priority : 32768 Address: 02:02:02:02:02:02
Designated port id : 0
Number of transitions to forwarding state: 0
Bpdus sent 0, received 0

Cause

Mismatch MSTP configurations on VSX peer switches.
Switches are not in the same MSTP region within the VSX environment.
STP configurations on VSX LAG ports must be the same on VSX switches.
The VSX pair is configured as a nonroot switch.

Action

Run the following commands for determining what is causing the ISL to be in a blocking state:
```
switch# show running-config spanning-tree
switch# show spanning-tree mst-config
switch# show vsx status
```
When you run the show vsx status command, verify that the ISL is in-sync.

Verify that the VSX peer switches are in the active and standby role when the ISL is the in-sync state by entering the show spanning-tree detail command:

switch# show spanning-tree detail
Spanning tree status : Enabled Protocol: MSTP

MST0
Root ID Priority : 32768
      MAC-Address: 02:02:02:02:02:02
      This bridge is the root
      Hello time (in seconds):2 Max Age (in seconds):20
      Forward Delay (in seconds):15

Bridge ID Priority: 32768
     MAC-Address: 02:02:02:02:02:02
     Hello time (in seconds):2 Max Age (in seconds):20
     Forward Delay (in seconds):15

Port   Role     State    Cost   Priority Type
------ -------- -------- ------ -------- -------
lag1   Disabled Blocking 20000  64       shared
lag100 Disabled Blocking 20000  64       shared

Topology change flag : False
Number of topology changes : 0
Last topology change occurred: 3876 seconds ago

Timers: Hello expiry 0, Forward delay expiry 0

Port lag1 id 321
Designated root has priority : 32768 Address: 02:02:02:02:02:02
Designated bridge has priority : 32768 Address: 02:02:02:02:02:02
Designated port id : 0
Multi-Chassis role : active
Number of transitions to forwarding state: 0
Bpdus sent 0, received 0

Verify if MSTP configurations are the same on the VSX peer switches by entering the following commands:
```
switch# show running-config spanning-tree
switch# show running-config spanning-tree vsx-peer
```
In a converged network, if any of MSTP ports are disabled by loop-protect because different instances have different root switches, remove loop-protect configuration from those ports.
Preferably, enable loop-protect on only edge ports or ports connected to STP unaware switches.
The admin path cost configured on downstream switches results in the VSX pair seeing the root switch as equal cost to the root switch from both VSX pair switches.