Lab: Root Guard, Loop Guard

This post will cover the Root Guard and Loop Guard features. I'll use the simplified topology from the previous post again.

SW4 is the root bridge. Gi0/1 on SW3 is blocking.

Root Guard

The Root Guard feature is used to secure the placement of the root bridge in a switched network. If a BPDU is received on a port where Root Guard is enabled, the port is moved into a Root Inconsistent state, which is effectively equal to a blocking state. Root Guard should be used on designated ports, where the root bridge should not appear. Although Root Guard is enabled at the port level, it actually works on a per-VLAN basis. To see this in action, I've created VLAN 2 on all switches. Now, let's enable Root Guard on SW4.

SW4(config)#interface range Gi0/3, Gi1/1
SW4(config-if-range)#spanning-tree guard root
SW4(config-if-range)#
*Oct 23 18:51:31.131: %SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port GigabitEthernet0/3.
*Oct 23 18:51:31.136: %SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port GigabitEthernet1/1.

Root Guard is enabled for both VLANs.

SW4#show spanning-tree interface Gi0/3 detail
Port 4 (GigabitEthernet0/3) of VLAN0001 is designated forwarding
Port path cost 4, Port priority 128, Port Identifier 128.4.
Designated root has priority 24577, address fa16.3ee9.46f6
Designated bridge has priority 24577, address fa16.3ee9.46f6
Designated port id is 128.4, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
Link type is shared by default
Root guard is enabled on the port
BPDU: sent 92, received 2

Port 4 (GigabitEthernet0/3) of VLAN0002 is designated forwarding
Port path cost 4, Port priority 128, Port Identifier 128.4.
Designated root has priority 24578, address fa16.3ee9.46f6
Designated bridge has priority 24578, address fa16.3ee9.46f6
Designated port id is 128.4, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
Link type is shared by default
Root guard is enabled on the port
BPDU: sent 45, received 40

SW4#show spanning-tree interface Gi1/1 detail
Port 6 (GigabitEthernet1/1) of VLAN0001 is designated forwarding
Port path cost 4, Port priority 128, Port Identifier 128.6.
Designated root has priority 24577, address fa16.3ee9.46f6
Designated bridge has priority 24577, address fa16.3ee9.46f6
Designated port id is 128.6, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
Link type is shared by default
Root guard is enabled on the port
BPDU: sent 90, received 0

Port 6 (GigabitEthernet1/1) of VLAN0002 is designated forwarding
Port path cost 4, Port priority 128, Port Identifier 128.6.
Designated root has priority 24578, address fa16.3ee9.46f6
Designated bridge has priority 24578, address fa16.3ee9.46f6
Designated port id is 128.6, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
Link type is shared by default
Root guard is enabled on the port
BPDU: sent 57, received 31

Now, let's try to make SW3 the root bridge for VLAN 1 by changing its priority to 4096.

SW3(config)#spanning-tree vlan 1 priority 4096

SW4 immeadiately puts the ports in the Root Inconsistent state.

SW4#

*Oct 23 19:04:38.323: %SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port GigabitEthernet0/3 on VLAN0001.

*Oct 23 19:04:39.323: %SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port GigabitEthernet1/1 on VLAN0001.

SW4#show spanning-tree

VLAN0001

Spanning tree enabled protocol ieee

Root ID Priority 24577

Address fa16.3ee9.46f6

This bridge is the root

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 24577 (priority 24576 sys-id-ext 1)

Address fa16.3ee9.46f6

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type

------------------- ---- --- --------- -------- --------------------------------

Gi0/3 Desg BKN*4 128.4 Shr *ROOT_Inc

Gi1/1 Desg BKN*4 128.6 Shr *ROOT_Inc

VLAN0002

Spanning tree enabled protocol ieee

Root ID Priority 24578

Address fa16.3ee9.46f6

This bridge is the root

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 24578 (priority 24576 sys-id-ext 2)

Address fa16.3ee9.46f6

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type

------------------- ---- --- --------- -------- --------------------------------

Gi0/3 Desg FWD 4 128.4 Shr

Gi1/1 Desg FWD 4 128.6 Shr

Note that only VLAN 1 is affected. VLAN 2 is still forwarding.

The ports will automatically recover when they stop receiving superior BPDUs. Remove the STP priority configuration on SW3 and verify the results on SW4.

SW3(config)#no spanning-tree vlan 1 priority 4096

SW4#

*Oct 23 19:08:42.618: %SPANTREE-2-ROOTGUARD_UNBLOCK: Root guard unblocking port GigabitEthernet0/3 on VLAN0001.

*Oct 23 19:08:43.618: %SPANTREE-2-ROOTGUARD_UNBLOCK: Root guard unblocking port GigabitEthernet1/1 on VLAN0001.

SW4#show spanning-tree

VLAN0001

Spanning tree enabled protocol ieee

Root ID Priority 24577

Address fa16.3ee9.46f6

This bridge is the root

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 24577 (priority 24576 sys-id-ext 1)

Address fa16.3ee9.46f6

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 15 sec

Interface Role Sts Cost Prio.Nbr Type

------------------- ---- --- --------- -------- --------------------------------

Gi0/3 Desg FWD 4 128.4 Shr

Gi1/1 Desg FWD 4 128.6 Shr

VLAN0002

Spanning tree enabled protocol ieee

Root ID Priority 24578

Address fa16.3ee9.46f6

This bridge is the root

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 24578 (priority 24576 sys-id-ext 2)

Address fa16.3ee9.46f6

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type

------------------- ---- --- --------- -------- --------------------------------

Gi0/3 Desg FWD 4 128.4 Shr

Gi1/1 Desg FWD 4 128.6 Shr

Loop Guard

Loop Guard is used to prevent STP loops caused by unidirectional links. If a non-designated (blocking) port stops receiving BPDUs, the port is eventually moved to the forwarding state. This can create a loop. If Loop Guard is enabled, that port is put in the Loop Inconsistent state. Loop Guard can be enabled globally (applied to point-to-point links) or per interface. As with Root Guard, the feature is enabled on the port level but applied on a per-VLAN basis.

SW3(config)#interface Gi0/1

SW3(config-if)#spanning-tree guard loop

SW3#show spanning-tree interface Gi0/1 detail

Port 2 (GigabitEthernet0/1) of VLAN0001 is alternate blocking

Port path cost 4, Port priority 128, Port Identifier 128.2.

Designated root has priority 24577, address fa16.3ee9.46f6

Designated bridge has priority 32769, address fa16.3ec4.8b80

Designated port id is 128.2, designated path cost 4

Timers: message age 0, forward delay 0, hold 0

Number of transitions to forwarding state: 1

Link type is shared by default

Loop guard is enabled on the port

BPDU: sent 119, received 583

Port 2 (GigabitEthernet0/1) of VLAN0002 is alternate blocking

Port path cost 4, Port priority 128, Port Identifier 128.2.

Designated root has priority 24578, address fa16.3ee9.46f6

Designated bridge has priority 32770, address fa16.3ec4.8b80

Designated port id is 128.2, designated path cost 4

Timers: message age 0, forward delay 0, hold 0

Number of transitions to forwarding state: 1

Link type is shared by default

Loop guard is enabled on the port

BPDU: sent 4, received 696

Next, configure BPDU Filter on SW1 port Gi0/1 to stop it from sending BPDUs to SW3. This should trigger Loop Guard.

SW1(config)#interface Gi0/1

SW1(config-if)#spanning-tree bpdufilter enable

SW3#

*Oct 23 19:21:38.639: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/1 on VLAN0002.

*Oct 23 19:21:40.288: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/1 on VLAN0001.

SW3#show spanning-tree

VLAN0001

Spanning tree enabled protocol ieee

Root ID Priority 24577

Address fa16.3ee9.46f6

Cost 4

Port 6 (GigabitEthernet1/1)

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)

Address fa16.3ec4.8b80

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type

------------------- ---- --- --------- -------- --------------------------------

Gi0/1 Desg BKN*4 128.2 Shr *LOOP_Inc

Gi1/1 Root FWD 4 128.6 Shr

VLAN0002

Spanning tree enabled protocol ieee

Root ID Priority 24578

Address fa16.3ee9.46f6

Cost 4

Port 6 (GigabitEthernet1/1)

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32770 (priority 32768 sys-id-ext 2)

Address fa16.3ec4.8b80

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type

------------------- ---- --- --------- -------- --------------------------------

Gi0/1 Desg BKN*4 128.2 Shr *LOOP_Inc

Gi1/1 Root FWD 4 128.6 Shr

Similar to Root Guard, Loop Guard recovers automatically. Once BPDUs are received on the port again, the port transitions back to the forwarding state.

SW1(config-if)#no spanning-tree bpdufilter enable

SW3#

*Oct 23 19:23:43.890: %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet0/1 on VLAN0002.

*Oct 23 19:23:45.603: %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet0/1 on VLAN0001.

Root Guard and Loop Guard are mutually exclusive. If Root Guard is configured on a port and Loop Guard is enabled on that port, Root Guard is disabled and vice versa.

SW4(config)#interface Gi0/3

SW4(config-if)#spanning-tree guard loop

*Oct 23 19:24:34.875: %SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard disabled on port GigabitEthernet0/3.

SW4(config-if)#spanning-tree guard root

*Oct 23 19:24:51.840: %SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port GigabitEthernet0/3.

Network Playroom

Search This Blog