Additional STP Protection Mechanisms
Network packets do not decrement the time-to-live portion of the header as a packet is forwarded in a Layer 2 topology. A network forwarding loop occurs when the logical topology allows for multiple active paths between two devices. Broadcast and multicast traffic wreak havoc as they are forwarded out of every switch port and continue the forwarding loop. High CPU consumption and low free memory space are common symptoms of a Layer 2 forwarding loop. In Layer 2 forwarding loops, in addition to constantly consuming switch bandwidth, the CPU spikes. Because the packet is received on a different interface, the switch must move the media access control (MAC) address from one interface to the next. The network throughput is impacted drastically; users are likely to notice a slowdown on their network applications, and the switches might crash due to exhausted CPU and memory resources.
The following are some common scenarios for Layer 2 forwarding loops:
STP disabled on a switch
A misconfigured load balancer that transmits traffic out multiple ports with the same MAC address
A misconfigured virtual switch that bridges two physical ports (Virtual switchestypically do not participate in STP.)
End users using a dumb network switch or hub
Catalyst switches detect a MAC address that is flapping between interfaces and notify via syslog with the MAC address of the host, VLAN, and ports between which the MAC address is flapping. These messages should be investigated to ensure that a forwarding loop does not exist. Example 3-8 shows a sample syslog message for a flapping MAC address where STP has been removed from the topology.
Example 3-8 Syslog Message for a Flapping MAC Address
12:40:30.044: %SW_MATM-4-MACFLAP_NOTIF: Host 70df.2f22.b8c7 in vlan 1 is flapping between port Gi1/0/3 and port Gi1/0/2
In this scenario, STP should be checked for all the switches hosting the VLAN mentioned in the syslog message to ensure that spanning tree is enabled and working properly.
Root Guard
Root guard is an STP feature that is enabled on a port-by-port basis; it prevents a configured port from becoming a root port. Root guard prevents a downstream switch (often misconfigured or rogue) from becoming a root bridge in a topology. Root guard functions by placing a port in an ErrDisabled state if a superior BPDU is received on a configured port. This prevents the configured DP with root guard from becoming an RP.
Root guard is enabled with the interface command spanning-tree guard root. Root guard is placed on designated ports toward other switches that should never become root bridges.
In the sample topology shown in Figure 3-1, root guard should be placed on SW2’s Gi1/0/4 port toward SW4 and on SW3’s Gi1/0/5 port toward SW5. This prevents SW4 and SW5 from ever becoming root bridges but still allows for SW2 to maintain connectivity to SW1 via SW3 if the link connecting SW1 to SW2 fails.
){kind=link}
STP Portfast
The generation of TCN for hosts does not make sense as a host generally has only one connection to the network. Restricting TCN creation to only ports that connect with other switches and network devices increases the L2 network’s stability and efficiency. The STP portfast feature disables TCN generation for access ports.
Another major benefit of the STP portfast feature is that the access ports bypass the earlier 802.1D STP states (learning and listening) and forward traffic immediately. This is beneficial in environments where computers use Dynamic Host Configuration Protocol (DHCP) or Preboot Execution Environment (PXE). If a BPDU is received on a portfast-enabled port, the portfast functionality is removed from that port.
The portfast feature is enabled on a specific access port with the command spanning-tree portfast or globally on all access ports with the command spanning-tree portfast default. If portfast needs to be disabled on a specific port when using the global configuration, you can use the interface configuration command spanning-tree portfast disable to remove portfast on that port.
Portfast can be enabled on trunk links with the command spanning-tree portfast trunk. However, this command should be used only with ports that are connecting to a single host (such as a server with only one NIC that is running a hypervisor with VMs on different VLANs). Running this command on interfaces connected to other switches, bridges, and so on can result in a bridging loop.
Example 3-9 shows how to enable portfast for SW1’s Gi1/0/13 port. Then the configuration is verified by examining the STP for VLAN 10 or examining the STP interface. Notice that the portfast ports are displayed with P2P Edge. The last section of output demonstrates how portfast is enabled globally for all access ports.
Example 3-9 Enabling STP Portfast on Specific Interfaces
SW1(config)# interface gigabitEthernet 1/0/13 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 10 SW1(config-if)# spanning-tree portfast
SW1# show spanning-tree vlan 10 ! Output omitted for brevity VLAN0010 Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/2 Desg FWD 4 128.2 P2p Gi1/0/3 Desg FWD 4 128.3 P2p Gi1/0/13 Desg FWD 4 128.13 P2p Edge
SW1# show spanning-tree interface gi1/0/13 detail Port 13 (GigabitEthernet1/0/13) of VLAN0010 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.7. Designated root has priority 32778, address 0062.ec9d.c500 Designated bridge has priority 32778, address 0062.ec9d.c500 Designated port id is 128.7, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 The port is in the portfast mode Link type is point-to-point by default BPDU: sent 23103, received
Example 3-10 shows how to enable portfast globally for all access ports on SW2 and then disable it for Gi1/0/8.
Example 3-10 Enabling STP Portfast Globally
SW2# conf t Enter configuration commands, one per line. End with CNTL/Z. SW2(config)# spanning-tree portfast default %Warning: this command enables portfast by default on all interfaces. You should now disable portfast explicitly on switched ports leading to hubs, switches and bridges as they may create temporary bridging loops. SW2(config)# interface gi1/0/8 SW2(config-if)# spanning-tree portfast disabl
BPDU Guard
BPDU guard is a safety mechanism that shuts down ports configured with STP portfast upon receipt of a BPDU. Assuming that all access ports have portfast enabled, this ensures that a loop cannot accidentally be created if an unauthorized switch is added to a topology.
BPDU guard is enabled globally on all STP portfast ports with the command spanning-tree portfast bpduguard default. BPDU guard can be enabled or disabled on a specific interface with the command spanning-tree bpduguard {enable | disable}.
Example 3-11 shows how to configure BPDU guard globally on SW1 for all access ports but with the exception of disabling BPDU guard on Gi1/0/8. The show spanning-tree interface interface-id detail command displays whether BPDU guard is enabled for the specified port.
Example 3-11 Configuring BPDU Guard
SW1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW1(config)# spanning-tree portfast bpduguard default SW1(config)# interface gi1/0/8 SW1(config-if)# spanning-tree bpduguard disable
SW1# show spanning-tree interface gi1/0/7 detail Port 7 (GigabitEthernet1/0/7) of VLAN0010 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.7. Designated root has priority 32778, address 0062.ec9d.c500 Designated bridge has priority 32778, address 0062.ec9d.c500 Designated port id is 128.7, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 The port is in the portfast mode Link type is point-to-point by default Bpdu guard is enabled by default BPDU: sent 23386, received 0 SW1# show spanning-tree interface gi1/0/8 detail Port 8 (GigabitEthernet1/0/8) of VLAN0010 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.8. Designated root has priority 32778, address 0062.ec9d.c500 Designated bridge has priority 32778, address 0062.ec9d.c500 Designated port id is 128.8, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 The port is in the portfast mode by default Link type is point-to-point by default BPDU: sent 23388, received 0
Example 3-12 shows the syslog messages that appear when a BPDU is received on a BPDU guard–enabled port. The port is then placed into an ErrDisabled state, as shown with the command show interfaces status.
Example 3-12 Detecting a BPDU on a BPDU Guard–Enabled Port
12:47:02.069: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gigabit Ethernet1/0/2 with BPDU Guard enabled. Disabling port. 12:47:02.076: %PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/2, putting Gi1/0/2 in err-disable state 12:47:03.079: %LINEPROTO-5-UPDOWN: Line protocol on Interface Gigabit Ethernet1/0/2, changed state to down 12:47:04.082: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/2, changed state to down
SW1# show interfaces status Port Name Status Vlan Duplex Speed Type Gi1/0/1 notconnect 1 auto auto 10/100/1000BaseTX Gi1/0/2 SW2 Gi1/0/1 err-disabled 1 auto auto 10/100/1000BaseTX Gi1/0/3 SW3 Gi1/0/1 connected trunk a-full a-1000 10/100/1000BaseT
By default, ports that are put in the ErrDisabled state because of BPDU guard do not automatically restore themselves. The Error Recovery service can be used to reactivate ports that are shut down for a specific problem, thereby reducing administrative overhead. To use Error Recovery to recover ports that were shut down from BPDU guard, use the command errdisable recovery cause bpduguard. The period that the Error Recovery checks for ports is configured with the command errdisable recovery interval time-seconds.
Example 3-13 demonstrates the configuration of the Error Recovery service for BPDU guard, verification of the Error Recovery service for BPDU guard, and the syslog messages from the process.
Example 3-13 Configuring Error Recovery Service
SW1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW1(config)# errdisable recovery cause bpduguard
SW1# show errdisable recovery ! Output omitted for brevity ErrDisable Reason Timer Status ----------------- -------------- arp-inspection Disabled bpduguard Enabled .. Recovery command: "clear Disabled Timer interval: 300 seconds Interfaces that will be enabled at the next timeout: Interface Errdisable reason Time left(sec) --------- ----------------- -------------- Gi1/0/2 bpduguard 295
! Syslog output from BPDU recovery. The port will be recovered, and then ! triggered again because the port is still receiving BPDUs. SW1# 01:02:08.122: %PM-4-ERR_RECOVER: Attempting to recover from bpduguard err-disable state on Gi1/0/2 01:02:10.699: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gigabit Ethernet1/0/2 with BPDU Guard enabled. Disabling port. 01:02:10.699: %PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/2, putting Gi1/0/2 in err-disable state
BPDU Filter
BPDU filter simply blocks BPDUs from being transmitted out a port. BPDU filter can be enabled globally or on a specific interface. The behavior changes depending on the configuration:
The global BPDU filter configuration uses the command spanning-tree portfast bpdufilter default, and the port sends a series of 10 to 12 BPDUs. If the switch receives any BPDUs, it checks to identify which switch is more preferred.
The preferred switch does not process any BPDUs that it receives, but it still transmits BPDUs to inferior downstream switches.
A switch that is not the preferred switch processes BPDUs that are received, but it does not transmit BPDUs to the superior upstream switch.
The interface-specific BPDU filter is enabled with the interface configuration command spanning-tree bpdufilter enable. The port does not send any BPDUs on an ongoing basis. If the remote port has BPDU guard on it, that generally shuts down the port as a loop prevention mechanism.
Example 3-14 shows SW1’s Gi1/0/2 statistics after BPDU is enabled on the Gi1/0/2 interface. In the first set of output, BPDU filter is enabled specifically on the Gi1/0/2 interface (thereby prohibiting any BPDUs from being sent or received). The second set of output enables BPDU filtering globally, so that BPDUs are transmitted when the port first becomes active; the filtering is verified by the number of BPDUs sent changing from 56 to 58.
Example 3-14 Verifying a BPDU Filter
! SW1 was enabled with BPDU filter only on port Gi1/0/2 SW1# show spanning-tree interface gi1/0/2 detail | in BPDU|Bpdu|Ethernet Port 2 (GigabitEthernet1/0/2) of VLAN0001 is designated forwarding Bpdu filter is enabled BPDU: sent 113, received 84 SW1# show spanning-tree interface gi1/0/2 detail | in BPDU|Bpdu|Ethernet Port 2 (GigabitEthernet1/0/2) of VLAN0001 is designated forwarding Bpdu filter is enabled BPDU: sent 113, received 84
! SW1 was enabled with BPDU filter globally SW2# show spanning-tree interface gi1/0/2 detail | in BPDU|Bpdu|Ethernet Port 1 (GigabitEthernet1/0/2) of VLAN0001 is designated forwarding BPDU: sent 56, received 5 SW2# show spanning-tree interface gi1/0/2 detail | in BPDU|Bpdu|Ethernet Port 1 (GigabitEthernet1/0/2) of VLAN0001 is designated forwarding BPDU: sent 58, received
Problems with Unidirectional Links
Fiber-optic cables consist of strands of glass/plastic that transmit light. A cable typically consists of one strand for sending data and another strand for receiving data on one side; the order is directly opposite at the remote site. Network devices that use fiber for connectivity can encounter unidirectional traffic flows if one strand is broken. In such scenarios, the interface still shows a line-protocol up state; however, BPDUs are not able to be transmitted, and the downstream switch eventually times out the existing root port and identifies a different port as the root port. Traffic is then received on the new root port and forwarded out the strand that is still working, thereby creating a forwarding loop.
A couple solutions can resolve this scenario:
STP loop guard
Unidirectional Link Detection
STP Loop Guard
STP loop guard prevents any alternative or root ports from becoming designated ports (ports toward downstream switches) due to loss of BPDUs on the root port. Loop guard places the original port in an ErrDisabled state while BPDUs are not being received. When BPDU transmission starts again on that interface, the port recovers and begins to transition through the STP states again.
Loop guard is enabled globally by using the command spanning-tree loopguard default, or it can be enabled on an interface basis with the interface command spanning-tree guard loop. It is important to note that loop guard should not be enabled on portfast-enabled ports (because it directly conflicts with the root/alternate port logic).
Example 3-15 demonstrates the configuration of loop guard on SW2’s Gi1/0/1 port.
Example 3-15 Configuring Loop Guard
SW2# config t SW2(config)# interface gi1/0/1 SW2(config-if)# spanning-tree guard loop ! Placing BPDU filter on SW2's RP (Gi1/0/1) bridge) triggers loop guard. SW2(config-if)# interface gi1/0/1 SW2(config-if)# spanning-tree bpdufilter enabled 01:42:35.051: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port Gigabit Ethernet1/0/1 on VLAN0001
SW2# show spanning-tree vlan 1 | b Interface Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------- Gi1/0/1 Root BKN*4 128.1 P2p *LOOP_Inc Gi1/0/3 Root FWD 4 128.3 P2p Gi1/0/4 Desg FWD 4 128.4 P2
At this point, the port is considered to be in an inconsistent state and does not forward any traffic. Inconsistent ports are viewed with the command show spanning-tree inconsistentports, as show in Example 3-16. Notice that an entry exists for all the VLANs carried across the Gi1/0/1 port.
Example 3-16 Viewing the Inconsistent STP Ports
SW2# show spanning-tree inconsistentports Name Interface Inconsistency -------------------- ------------------------ ------------------ VLAN0001 GigabitEthernet1/0/1 Loop Inconsistent VLAN0010 GigabitEthernet1/0/1 Loop Inconsistent VLAN0020 GigabitEthernet1/0/1 Loop Inconsistent VLAN0099 GigabitEthernet1/0/1 Loop Inconsistent Number of inconsistent ports (segments) in the system : 4
Unidirectional Link Detection
Unidirectional Link Detection (UDLD) allows for the bidirectional monitoring of fiber-optic cables. UDLD operates by transmitting UDLD packets to a neighbor device that includes the system ID and port ID of the interface transmitting the UDLD packet. The receiving device then repeats that information, including its system ID and port ID, back to the originating device. The process continues indefinitely. UDLD operates in two different modes:
Normal: In normal mode, if a frame is not acknowledged, the link is considered undetermined and the port remains active.
Aggressive: In aggressive mode, when a frame is not acknowledged, the switch sends another eight packets in 1-second intervals. If those packets are not acknowledged, the port is placed into an error state.
UDLD is enabled globally with the command udld enable [aggressive]. This enables UDLD on any small form-factor pluggable (SFP)-based port. UDLD can be disabled on a specific port with the interface configuration command udld port disable. UDLD recovery can be enabled with the command udld recovery [interval time], where the optional interval keyword allows for the timer to be modified from the default value of 5 minutes. UDLD can be enabled on a port-by-port basis with the interface configuration command udld port [aggressive], where the optional aggressive keyword places the ports in UDLD aggressive mode.
Example 3-17 shows how to enable UDLD normal mode on SW1.
Example 3-17 Configuring UDLD
SW1# conf t Enter configuration commands, one per line. End with CNTL/Z. SW1(config)# udld enabl
UDLD must be enabled on the remote switch as well. Once it is configured, the status of UDLD neighborship can be verified with the command show udld neighbors. More detailed information can be viewed with the command show udld interface-id.
Example 3-18 displays the verification of SW1’s neighborship with SW2. The link is operating in a bidirectional state. More information is obtained with the show udld Te1/1/3 command, which includes the current state, device IDs (that is, serial numbers), originating interface IDs, and return interface IDs.
Example 3-18 Verifying UDLD Neighbors and Switch Port Status
SW1# show udld neighbors Port Device Name Device ID Port ID Neighbor State ---- ----------- --------- ------- -------------- Te1/1/3 081C4FF8B0 1 Te1/1/3 Bidirectional
SW1# show udld Te1/1/3
Interface Te1/1/3
---
Port enable administrative configuration setting: Follows device default
Port enable operational state: Enabled
Current bidirectional state: Bidirectional
Current operational state: Advertisement - Single neighbor detected
Message interval: 15000 ms
Time out interval: 5000 ms
Port fast-hello configuration setting: Disabled
Port fast-hello interval: 0 ms
Port fast-hello operational state: Disabled
Neighbor fast-hello configuration setting: Disabled
Neighbor fast-hello interval: Unknown
Entry 1
---
Expiration time: 41300 ms
Cache Device index: 1
Current neighbor state: Bidirectional
Device ID: 081C4FF8B0
Port ID: Te1/1/3
Neighbor echo 1 device: 062EC9DC50
Neighbor echo 1 port: Te1/1/3
TLV Message interval: 15 sec
No TLV fast-hello interval
TLV Time out interval: 5
TLV CDP Device name: SW2
Exam Preparation Tasks
As mentioned in the section “How to Use This Book” in the Introduction, you have a couple of choices for exam preparation: the exercises here, Chapter 30, “Final Preparation,” and the exam simulation questions in the Pearson Test Prep Software Online.