Day 21 STP Loop Guard

1. Loop Guard is an additional STP protection mechanism that prevents Layer 2 loops by disabling a port if it unexpectedly stops receiving BPDUs, rather than allowing it to transition to the Forwarding state.

2. Unidirectional links are network links where data transmission occurs in only one direction, typically caused by Layer 1 physical issues, and are more common with fiber-optic cables than copper UTP cables.

3. Fiber-optic connections use two separate fibers (Tx and Rx), and if one fiber is damaged, it can disrupt data flow in one direction while the other remains functional, potentially creating a unidirectional link.

4. When a port stops receiving BPDUs without Loop Guard, its max age timer expires, and it assumes there's no longer a loop, causing it to become a Designated port and transition to Forwarding—potentially creating a Layer 2 loop.

5. Loop Guard and Root Guard are mutually exclusive—they cannot be enabled on the same port simultaneously because they serve opposite purposes.

• Loop Guard protects Root ports and Non-Designated ports (ports that should receive BPDUs)

• Root Guard protects Designated ports (ports that should send BPDUs)

• When Loop Guard triggers, the port enters the broken (loop inconsistent) state

• The port remains up/up but is blocked by STP (not physically shut down)

• Recovery is automatic—when BPDUs resume, the port is re-enabled

• More specific configurations (interface-level) override less specific ones (global)

Timers

• Max Age Timer: 20 seconds (default) - time before a port assumes BPDUs are lost

• BPDU Hello Interval: 2 seconds

Commands

1. Confusing Loop Guard and Root Guard purposes

   • Loop Guard = Non-Designated/Root ports (receivers)

   • Root Guard = Designated ports (senders)

2. Thinking Loop Guard prevents unidirectional links

   • It does NOT prevent them; it only detects and protects against their effects

3. Forgetting they're mutually exclusive

   • You cannot have both Loop Guard and Root Guard on the same port

4. Confusing "broken" states

   • Loop Guard → "loop inconsistent"

   • Root Guard → "root inconsistent"

5. Assuming the port goes down

   • The port stays up/up; only STP blocks it

"Loop Guard Loves Listeners"

• Loop Guard goes on ports that LISTEN for BPDUs (Root and Non-Designated ports)

"Root Guard Rules Roots"

• Root Guard prevents ports from BECOMING Root ports (goes on Designated ports)

"BKN = Broken, LOOP_Inc = Loop Inconsistent"

• Show command output indicators

"Fiber = Two Fibers, One Problem = Unidirectional"

• Remember fiber's vulnerability to unidirectional issues

"Specific Beats General"

• Interface commands override global commands in IOS

Scenario: Three-Switch Triangle Topology

SW1 (Root Bridge)

/ \

SW2 ----------- SW3

• SW3's port toward SW2 is Non-Designated (Blocking)

• If SW2→SW3 fiber breaks (unidirectional), SW3 stops receiving BPDUs

• Without Loop Guard: SW3 port becomes Designated → LOOP!

• With Loop Guard: SW3 port enters Broken state → No loop

Where to Apply Each Guard:

• SW3 ports to SW1 and SW2: Loop Guard (receiving BPDUs)

• SW3 port to untrusted switch: Root Guard (sending BPDUs)

To protect the network by blocking a port if it unexpectedly stops receiving BPDUs, preventing it from becoming a Designated port and causing a Layer 2 loop.

A network link where data transmission occurs in only one direction, typically caused by Layer 1 issues on fiber-optic cables.

Fiber connections use two separate fibers (Tx and Rx). If one fiber is damaged, it disrupts data flow in one direction while the other remains functional. Fiber is also more vulnerable to physical damage.

Broken (loop inconsistent) state - the port is blocked but remains up/up.

spanning-tree guard loop (in interface configuration mode)

spanning-tree loopguard default (in global configuration mode)

Automatic - when the port starts receiving BPDUs again, it's automatically re-enabled.

Root ports and Non-Designated ports (ports that receive BPDUs from Designated ports).

Designated ports (ports that send BPDUs).

No, they are mutually exclusive. Configuring one will disable the other.

Root Guard takes effect on that port (interface command overrides global command), and Loop Guard is disabled on that specific port.

BKN = Broken state; LOOP_Inc = Loop Inconsistent (Loop Guard has blocked the port)

show spanning-tree interface [interface-id] detail

The switch stops receiving BPDUs, the max age timer expires, the port becomes Designated and starts forwarding, creating a loop.

20 seconds

Every 2 seconds (Hello timer)

No, the port remains up/up; only STP blocks it.

1) Software bug preventing a switch from sending BPDUs, 2) Hardware issue causing a unidirectional link

The more specific configuration (interface-level) takes precedence over the less specific (global) configuration.