Spanning Tree Protocol (STP) resolves physically redundant topologies into loop-free, tree-like topologies. The biggest issue with STP is that some hardware failures can cause it to fail. This failure creates forwarding loops (or STP loops). Major network outages are caused by STP loops.
The loop guard STP feature that is intended to improve the stability of the Layer 2 networks. This document also describes Bridge Protocol Data Unit (BPDU) skew detection. BPDU skew detection is a diagnostic feature that generates syslog messages when BPDUs are not received in time.
- The STP loop guard feature was introduced in CatOS version 6.2.1 of the Catalyst software for Catalyst 4000 and Catalyst 5000 platforms and in version 6.2.2 for the Catalyst 6000 platform.
- The BPDU skew detection feature was introduced in CatOS version 6.2.1 of the Catalyst software for Catalyst 4000 and Catalyst 5000 platforms and in version 6.2.2 for the Catalyst 6000 platform.
- The STP loop guard feature was introduced in Cisco IOS Software Release 12.1(12c)EW for Catalyst 4500 switches and Cisco IOS Software Release 12.1(11b)EX for Catalyst 6500.
- The BPDU skew detection feature is not supported in Catalyst switches running Cisco IOS system software.
Brief Summary of STP Port Roles
Internally, STP assigns to each bridge (or switch) port a role that is based on configuration, topology, relative position of the port in the topology, and other considerations. The port role defines the behavior of the port from the STP point of view. Based on the port role, the port either sends or receives STP BPDUs and forwards or blocks the data traffic. This list provides a brief summary of each STP port role:
- Designated: One designated port is elected per link (segment). The designated port is the port closest to the root bridge. This port sends BPDUs on the link (segment) and forwards traffic towards the root bridge. In an STP converged network, each designated port is in the STP forwarding state.
- Root: The bridge can have only one root port. The root port is the port that leads to the root bridge. In an STP converged network, the root port is in the STP forwarding state.
- Alternate: Alternate ports lead to the root bridge, but are not root ports. The alternate ports maintain the STP blocking state.
- Backup: This is a special case when two or more ports of the same bridge (switch) are connected together, directly or through shared media. In this case, one port is designated, and the remaining ports block. The role for this port is backup.
It is a feature of STP. It should be enabling on all the Non-DP ports (root & blocking).
After enabling loop guard if switch is receiving BPDUs on a switchport constantly then it will remain in working mode, but if it stops to receive BPDUs on switchport then it will put that switch port in loop inconsistent mode.
It is a feature when it receives a BPDU, it remain silent, if it will not receive BPDU then it will put that port in loop inconsistent state or error disable state.
(Note: always applied on Non-DP ports.)
Consider this example in order to illustrate this behavior:
Switch A is the root switch. Switch C does not receive BPDUs from switch B due to unidirectional link failure on the link between switch B and switch C.
Without loop guard, the STP blocking port on switch C transitions to the STP listening state when the max_age timer expires, and then it transitions to the forwarding state in two times the forward_delay time. This situation creates a loop.
With loop guard enabled, the blocking port on switch C transitions into STP loop-inconsistent state when the max_age timer expires. A port in STP loop-inconsistent state does not pass user traffic, so a loop is not created. (The loop-inconsistent state is effectively equal to blocking state.)
A feature when it receives BPDU it put that port in error disable mode.
(Note: Always applied on access port.)
For enable – shut & no shut
When we enable port fast then we save only 32 sec convergence time but STP is still working on the port, if we want to block STP completely on a port then we have to use BPDU filter.
(Note: Always applied on access port.)
BPDU Skew Detection
STP operation relies heavily on the timely reception of BPDUs. At every hello_time message (2 seconds by default), the root bridge sends BPDUs. Non-root bridges do not regenerate BPDUs for each hello_time message, but they receive relayed BPDUs from the root bridge. Therefore, every non-root bridge should receive BPDUs on every VLAN for each hello_time message. In some cases, BPDUs are lost, or the bridge CPU is too busy to relay BPDU in a timely manner. These issues, as well as other issues, can cause BPDUs to arrive late (if they arrive at all). This issue potentially compromises the stability of the spanning tree topology.
BPDU skew detection allows the switch to keep track of BPDUs that arrive late and to notify the administrator with syslog messages. For every port on which a BPDU has ever arrived late (or has skewed), skew detection reports the most recent skew and the duration of the skew (latency). It also reports the longest BPDU delay on this particular port.
In order to protect the bridge CPU from overload, a syslog message is not generated every time BPDU skewing occurs. Messages are rate-limited to one message every 60 seconds. However, should the delay of BPDU exceed max_age divided by 2 (which equals 10 seconds by default), the message is immediately printed.
(Note: BPDU skew detection is a diagnostic feature. Upon detection of BPDU skewing, it sends a syslog message. BPDU skew detection takes no further corrective action.)
This is an example of a syslog message generated by BPDU skew detection:
%SPANTREE-2-BPDU_SKEWING: BPDU skewed with a delay of 10 secs (max_age/2)
UDLD (Uni Directional Link Detection)
UDLD was designed for fiber cables if there is an odd link failure in this situation link status would be up but communication is not possible. To detect this problem we enable UDLD. UDLD sends special message over the trunk and it hope that another switch must echo the same message with same link. If a switch receives echo message it means link is fine. Otherwise there is a problem with link. UDLD takes action according to its modes.
- Normal: Syslog Message send
Loop Guard versus UDLD
Loop guard and Unidirectional Link Detection (UDLD) functionality overlap, partly in the sense that both protect against STP failures caused by unidirectional links. However, these two features differ in functionality and how they approach the problem. This table describes loop guard and UDLD functionality:
|Autorecover||Yes||Yes, with err-disable timeout feature|
|Protection against STP failures caused by unidirectional links||Yes, when enabled on all root and alternate ports in redundant topology||Yes, when enabled on all links in redundant topology|
|Protection against STP failures caused by problems in the software (designated switch does not send BPDU)||Yes||No|
|Protection against miswiring||No||Yes|
STP Protection Example
We enable root guard on all the Designated Port of Switches
Sw4#sh spanning tree
Here we can see the Sw4 is the root bridge. All the ports of Sw4 is DP
Sw4 (config) #int range fa0/19 -24
Sw4 (config-if) #spanning-tree guard root
There is no DP port
21 to 24 is DP
Sw2 (config) #int range fa0/21 – 24
Sw2 (config-if) #spanning-tree guard root
DP is 19 and 20
Sw1 (config) #int range fa0/19 – 20
Sw1 (config-if) #spanning-tree guard root
Finally we enabled root guard on all the switches DP ports. Now we will make Sw3 as Root Bridge for vlan 1.
Sw3 (config) #spanning-tree vlan 1 priority 0
Now we can see root guard send the port in root inconsistent mode.
Sw3 (config) #no spanning-tree vlan 1 priority 0
It will apply on all non-DP and blocking port
Fa0/21 is the root port
Sw1 (config) #int fa0/21
Sw1 (config-if) #spanning-tree guard loop
Sw4 (config) #int fa0/21
Sw4 (config-if) #spanning-tree bpdufilter enable
Sw4 (config) #int fa0/21
Sw4 (config-if) #spanning-tree bpdufilter disable
Only applied on Access ports
Sw1 (config) #int range fa0/1 – 18
Sw1 (config-if-range) #spanning-tree bpduguard enable
Sw1 (config-if-range) #spanning-tree bpdufilter enable
For globally enabling
Sw1 (config) #spanning-tree portfast bpduguard default
Sw1 (config) #spanning-tree portfast default
Sw1 (config) #spanning-tree portfast bpdufilter default
Sw1 (config) #udld enable
Sw1 (config) #udld aggressive
Sw2 (config) #udld enable
Sw2 (config) #udld aggressive
Sw3 (config) #udld enable
Sw3 (config) #udld aggressive
Sw4 (config) #udld enable
Sw4 (config) #udld aggressive