Browsed by
Tag: STP

CCIE: Root Guard, BPDU Guard, BPDU Filter, and Loop Guard

CCIE: Root Guard, BPDU Guard, BPDU Filter, and Loop Guard

The BPDU guard feature can be globally enabled on the switch or can be enabled per port, but the feature operates with some differences.
At the global level, you enable BPDU guard on Port Fast-enabled ports by using the spanning-tree portfast bpduguard default global configuration command. Spanning tree shuts down ports that are in a Port Fast-operational state if any BPDU is received on them. In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port means an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the port in the error-disabled state. When this happens, the switch shuts down the entire port on which the violation occurred.

The “default” global option works in conjunction with spanning-tree portfast default on interfaces that are in the portfast state.

verify with “sh interface fa x/x status”
test bpdu to router with bridging interface “bridge 1 proto ieee , int fa x/x bridge-group 1”

The BPDU filtering feature can be globally enabled on the switch or can be enabled per interface, but the feature operates with some differences.

At the global level, you can enable BPDU filtering on Port Fast-enabled interfaces by using the spanning-tree portfast bpdufilter default global configuration command. This command prevents interfaces that are in a Port Fast-operational state from sending or receiving BPDUs. The interfaces still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. You should globally enable BPDU filtering on a switch so that hosts connected to these interfaces do not receive BPDUs. If a BPDU is received on a Port Fast-enabled interface, the interface loses its Port Fast-operational status, and BPDU filtering is disabled.

At the interface level, you can enable BPDU filtering on any interface by using the spanning-tree bpdufilter enable interface configuration command without also enabling the Port Fast feature. This command prevents the interface from sending or receiving BPDUs.
BPDU filter works in conjuction with portfast as well.

If BPDU’s are dectect the interfaces will revert out of portfast mode.

Verify with “sh span inter fa x/x portfast” RootGuard will not errdisable a port. It will go into root inconsistant state until superior BPDUs cease.

Loop Guard is similar to UDLD except it uses STP bpdu keepalives to determine if there is a uni-directional link failure.

Understanding Loop Guard

You can use loop guard to prevent alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link.This feature is most effective when it is enabled on the entire switched network. Loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports.

You can enable this feature by using the spanning-tree loopguard default global configuration command.

When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports.

When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports only if the interface is blocked by loop guard in all MST instances. On a boundary port, loop guard blocks the interface in all MST instances.

Understanding Root Guard

The Layer 2 network of a service provider (SP) can include many connections to switches that are not owned by the SP. In such a topology, the spanning tree can reconfigure itself and select a customer switch as the root switch, as shown in Figure 18-8. You can avoid this situation by enabling root guard on SP switch interfaces that connect to switches in your customer’s network. If spanning-tree calculations cause an interface in the customer network to be selected as the root port, root guard then places the interface in the root-inconsistent (blocked) state to prevent the customer’s switch from becoming the root switch or being in the path to the root.

If a switch outside the SP network becomes the root switch, the interface is blocked (root-inconsistent state), and spanning tree selects a new root switch. The customer’s switch does not become the root switch and is not in the path to the root.

If the switch is operating in multiple spanning-tree (MST) mode, root guard forces the interface to be a designated port. If a boundary port is blocked in an internal spanning-tree (IST) instance because of root guard, the interface also is blocked in all MST instances. A boundary port is an interface that connects to a LAN, the designated switch of which is either an IEEE 802.1D switch or a switch with a different MST region configuration.

Root guard enabled on an interface applies to all the VLANs to which the interface belongs. VLANs can be grouped and mapped to an MST instance.

You can enable this feature by using the spanning-tree guard root interface configuration command.

CCIE: STP (802.1d)

CCIE: STP (802.1d)

So, first a little history on Spanning tree protocol (STP). Based on an algorithm created by Radia Pearlman in 1985. http://en.wikipedia.org/wiki/Radia_Perlman

Became a standard IEEE protocol in 1990. Still widely deployed. Flavors of spanning tree. 802.1d (ieee), 802.1w (rapid), and 802.1s (mst). Evolution of STP, Cisco vPC (2-way non blocking, still requires STP) and Fabric Path (eliminates STP completely). TRILL is a standardized version of Fabric Path. Both TRILL and Fabric Path utilize a link state protocol (IS-IS) as their loop prevention method.

Specific Cisco enhancement to 802.1d (prior to 802.1w): UplinkFast and BackboneFast

UplinkFast: The UplinkFast feature is designed to run in a switched environment when the switch has at least one alternate/backup root port (port in blocking state), that is why Cisco recommends that UplinkFast be enabled only for switches with blocked ports, typically at the access-layer. Do not use on switches without the implied topology knowledge of a alternative/backup root link typically to distribution and core switches in Cisco multilayer design. ONLY enable on NON-ROOT switches. 

In order to be effective, the feature needs to have blocked ports that provides redundant connectivity to the root. As soon as Uplink Fast is configured on a switch, switch automatically adjusts some STP parameters are adjusted in order to help achieve this:

  • The bridge priority of the switch is increased to a significantly higher value than the default. This ensures that the switch is not likely to be elected root bridge, which does not have any root ports (all ports are designated).
  • All the ports of the switch have their cost increased by 3000. This ensures that switch ports are not likely be elected designated ports.

BackboneFast: