Protecting spanning tree: PortFast, BPDU Guard, Root Guard and Loop Guard

A story: the cheap switch under the desk

In a busy accounts office, Rakesh needs two more network sockets for his new printer and laptop. He buys a small 5-port unmanaged switch from the local market and plugs it into the wall socket. That part is harmless. Then, thinking "two cables will be faster", he plugs a second cable from the little switch into the other wall socket on his desk. Both sockets lead to the same access switch: he has just built a loop.

Most unmanaged switches do not run STP; they simply pass BPDUs along like any other multicast frame. Without protection, the access switch might take up to 30 seconds to sort things out, or worse, if spanning tree was tuned badly or disabled, a broadcast storm would take down the whole floor. With the protection in this topic, the access switch sees its own BPDU come back in on a user port and shuts that one port down in a fraction of a second. Rakesh loses one socket; everyone else keeps working.

PortFast: no waiting on edge ports

Normally a port that comes up spends 30 seconds in listening and learning (classic STP) before forwarding. For a PC, printer or server, that wait is pointless: a single end device cannot create a loop. It even causes trouble, because the PC may give up on DHCP before the port forwards. PortFast makes the port go straight to forwarding. In RSTP terms, it makes the port an edge port.

SW1(config)# interface range fastEthernet 0/1 - 24
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# spanning-tree portfast
SW1(config-if-range)# exit
SW1(config)# spanning-tree portfast default

BPDU Guard: switches not welcome here

End devices never send BPDUs. So if a BPDU arrives on a PortFast port, something is wrong: someone plugged in a switch, or a loop sent your own BPDU back. BPDU Guard reacts by putting the port into the err-disabled state, which is effectively shut down by the switch itself. This is what saved Rakesh's office.

SW1(config)# interface fastEthernet 0/5
SW1(config-if)# spanning-tree bpduguard enable
SW1(config-if)# exit
SW1(config)# spanning-tree portfast bpduguard default

Root Guard: keep the root where you put it

Suppose someone connects a lab switch with priority 0 to an access switch. Its BPDUs are superior (they claim a better root), and the whole network would rebuild its tree around this lab switch. Root Guard, configured on ports where a root should never appear (typically distribution ports facing access switches), ignores superior BPDUs and puts the port into a root-inconsistent state, where it does not forward. When the superior BPDUs stop, the port recovers on its own.

DSW1(config)# interface gigabitEthernet 1/0/10
DSW1(config-if)# spanning-tree guard root

Loop Guard, briefly

A blocked port stays blocked because it keeps receiving BPDUs. If a fibre fails in only one direction, BPDUs stop arriving even though the link is up, and the port would wrongly move to forwarding and create a loop. Loop Guard (spanning-tree guard loop, on root and alternate ports) puts such a port into a loop-inconsistent state instead, and lets it recover when BPDUs return.

Recovering an err-disabled port

First remove the cause (take away the extra cable or switch). Then bring the port back by hand, or let the switch try again automatically after an interval (300 seconds by default).

SW1# show interfaces status err-disabled
SW1# configure terminal
SW1(config)# interface fastEthernet 0/5
SW1(config-if)# shutdown
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# errdisable recovery cause bpduguard
SW1(config)# errdisable recovery interval 300