Chapter 3. Advanced STP Tuning
This chapter covers the following subjects:
STP Topology Tuning: This section explains some of the options for modifying the root bridge location or moving blocking ports to designated ports.
Additional STP Protection Mechanisms: This section examines protection mechanisms such as root guard, BPDU guard, and STP loop guard.
This chapter reviews techniques for configuring a switch to be guaranteed as the root bridge or as a backup root bridge for a Layer 2 topology. In addition, this chapter explains features that prevent other switches from unintentionally taking over the root bridge role. The chapter also explains other common features that are used in Cisco’s enterprise campus validated design guides.
“Do I Know This Already?” Quiz
The “Do I Know This Already?” quiz allows you to assess whether you should read the entire chapter. If you miss no more than one of these self-assessment questions, you might want to move ahead to the “Exam Preparation Tasks” section. Table 3-1 lists the major headings in this chapter and the “Do I Know This Already?” quiz questions covering the material in those headings so you can assess your knowledge of these specific areas. The answers to the “Do I Know This Already?” quiz appear in Appendix A, “Answers to the ‘Do I Know This Already?’ Quiz Questions.”
Table 3-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping
Foundation Topics Section |
Questions |
STP Topology Tuning |
1–3 |
Additional STP Protection Mechanisms |
4–6 |
1. A switch’s STP priority can be configured in increments of ______.
1
256
2048
4096
2. True or false: The advertised path cost includes the advertising link’s port cost as part of the configuration BPDU advertisement.
True
False
3. True or false: The switch port with the lower STP port priority is more preferred.
True
False
4. What happens to a switch port when a BPDU is received on it when BPDU guard is enabled on that port?
A message syslog is generated, and the BPDU is filtered.
A syslog message is not generated, and the BPDU is filtered.
A syslog message is generated, and the port is sent back to a listening state.
A syslog message is generated, and the port is shut down.
5. Enabling root guard on a switch port does what?
Upon receipt of an inferior BPDU, the port is shut down.
Upon receipt of a superior BPDU, the port is shut down.
Upon receipt of an inferior BPDU, the BPDU is filtered.
When the root port is shut down, only authorized designated ports can become root ports.
6. UDLD solves the problem of ______.
time for Layer 2 convergence
a cable sending traffic in only one direction
corrupt BPDU packets
flapping network links
Answers to the “Do I Know This Already?” quiz:
1 D
2 B
3 A
4 D
5 B
6 B
Foundation Topics
STP Topology Tuning
A properly designed network strategically places the root bridge on a specific switch and modifies which ports should be designated ports (that is, forwarding state) and which ports should be alternate ports (that is, discarding/blocking state). Design considerations factor in hardware platform, resiliency, and network topology. This chapter uses the same reference topology from Chapter 2, “Spanning Tree Protocol,” as shown in Figure 3-1.
Figure 3-1 STP Topology for Tuning
Root Bridge Placement
Ideally the root bridge is placed on a core switch, and a secondary root bridge is designated to minimize changes to the overall spanning tree. Root bridge placement is accomplished by lowering the system priority on the root bridge to the lowest value possible, raising the secondary root bridge to a value slightly higher than that of the root bridge, and (ideally) increasing the system priority on all other switches. This ensures consistent placement of the root bridge. The priority is set with either of the following commands:
spanning-tree vlan vlan-id priority priority: The priority is a value between 0 and 61,440, in increments of 4,096.
spanning-tree vlan vlan-id root {primary | secondary} [diameter diameter]: This command executes a script that modifies certain values. The primary keyword sets the priority to 24,576, and the secondary keyword sets the priority to 28,672.
The optional diameter command makes it possible to tune the Spanning Tree Protocol (STP) convergence and modifies the timers; it should reference the maximum number of Layer 2 hops between a switch and the root bridge. The timers do not need to be modified on other switches because they are carried throughout the topology through the root bridge’s bridge protocol data units (BPDUs).
Example 3-1 verifies the initial priority for VLAN 1 on SW1 and then checks how the change is made. Afterward, the priority is checked again to ensure that the priority is lowered.
Example 3-1 Changing the STP System Priority on SW1
! Verification of SW1 Priority before modifying the priority SW1# show spanning-tree vlan 1 VLAN0001 Spanning tree enabled protocol rstp Root ID Priority 32769 Address 0062.ec9d.c500 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 0062.ec9d.c500 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
! Configuring the SW1 priority as primary root for VLAN 1
SW1(config)# spanning-tree vlan 1 root primary
! Verification of SW1 Priority after modifying the priority SW1# show spanning-tree vlan 1 VLAN0001 Spanning tree enabled protocol rstp Root ID Priority 24577 Address 0062.ec9d.c500 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 24577 (priority 24576 sys-id-ext 1) Address 0062.ec9d.c500 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/2 Desg FWD 4 128.2 P2p Gi1/0/3 Desg FWD 4 128.3 P2p Gi1/0/14 Desg FWD 4 128.14 P2p
Example 3-2 verifies the priority for VLAN 1 on SW2 before changing its priority so that it will be the backup root bridge in the event of a failure with SW1. Notice that the root bridge priority is now 24,577, and the local switch’s priority is initially set to 32,769 (the default). Then the command spanning-tree vlan 1 root secondary is executed to modify SW2’s priority, setting it to 28,673.
Example 3-2 Changing the STP System Priority on SW2
! Verification of SW2 Priority before modifying the priority SW2# show spanning-tree vlan 1 ! Output omitted for brevity VLAN0001 Spanning tree enabled protocol rstp Root ID Priority 24577 Address 0062.ec9d.c500 Cost 4 Port 1 (GigabitEthernet1/0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 0081.c4ff.8b00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Root FWD 4 128.1 P2p Gi1/0/3 Desg FWD 4 128.3 P2p Gi1/0/4 Desg FWD 4 128.4 P2p
! Configuring the SW2 priority as root secondary for VLAN 1
SW2(config)# spanning-tree vlan 1 root secondary
SW2# show spanning-tree vlan 1 VLAN0001 Spanning tree enabled protocol rstp Root ID Priority 24577 Address 0062.ec9d.c500 Cost 4 Port 1 (GigabitEthernet1/0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 28673 (priority 28672 sys-id-ext 1) Address 0081.c4ff.8b00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Root FWD 4 128.1 P2p Gi1/0/3 Desg FWD 4 128.3 P2p Gi1/0/4 Desg FWD 4 128.4 P2p
The placement of the root bridge is an important decision and often should be chosen to minimize the number of hops to the furthest switch in the topology. The design should consider where redundant connections exist, connections that will be blocked, and the ability (performance) for the root switch to handle cross-switch traffic. Generally, root switches are at Layer 2/Layer 3 boundaries.
The best way to prevent erroneous devices from taking over the STP root role is to set the priority to 0 for the primary root switch and to 4096 for the secondary root switch. In addition, root guard should be used (as discussed later in this chapter).
Modifying STP Root Port and Blocked Switch Port Locations
The STP port cost is used in calculating the STP tree. When a switch generates the BPDUs, the total path cost includes only the calculated metric to the root and does not include the cost of the port out which the BPDU is advertised. The receiving switch adds the port cost for the interface on which the BPDU was received in conjunction to the value of the total path cost in the BPDU.
In Figure 3-2, SW1 advertises its BPDUs to SW3 with a total path cost of 0. SW3 receives the BPDU and adds its STP port cost of 4 to the total path cost in the BPDU (0), resulting in a value of 4. SW3 then advertises the BPDU toward SW5 with a total path cost of 4, to which SW5 then adds its STP port cost cost of 4. SW5 therefore reports a total path cost of 8 to reach the root bridge via SW3.
Figure 3-2 STP Path Cost Calculation
The logic is confirmed in the output of Example 3-3. Notice that there is not a total path cost in SW1’s output.
Example 3-3 Verifying the Total Path Cost
SW1# show spanning-tree vlan 1 ! Output omitted for brevity VLAN0001 Root ID Priority 32769 Address 0062.ec9d.c500 This bridge is the root .. Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/2 Desg FWD 4 128.2 P2p Gi1/0/3 Desg FWD 4 128.3 P2p
SW3# show spanning-tree vlan 1 ! Output omitted for brevity VLAN0001 Root ID Priority 32769 Address 0062.ec9d.c500 Cost 4 Port 1 (GigabitEthernet1/0/1) .. Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Root FWD 4 128.1 P2p Gi1/0/2 Altn BLK 4 128.2 P2p Gi1/0/5 Desg FWD 4 128.5 P2p
SW5# show spanning-tree vlan 1 ! Output omitted for brevity VLAN0001 Root ID Priority 32769 Address 0062.ec9d.c500 Cost 8 Port 3 (GigabitEthernet1/0/3) .. Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/3 Root FWD 4 128.3 P2p Gi1/0/4 Altn BLK 4 128.4 P2p Gi1/0/5 Altn BLK 4 128.5 P2p
By changing the STP port costs with the command spanning tree [vlan vlan-id] cost cost, you can modify the STP forwarding path. You can lower a path that is currently an alternate port while making it designated, or you can raise the cost on a port that is designated to turn it into a blocking port. The spanning tree command modifies the cost for all VLANs unless the optional vlan keyword is used to specify a VLAN.
Example 3-4 demonstrates the modification of SW3’s port cost for Gi1/0/1 to a cost of 1, which impacts the port state between SW2 and SW3. SW2 receives a BPDU from SW3 with a cost of 5, and SW3 receives a BPDU from SW2 with a cost of 8. Now SW3’s Gi1/0/2 is no longer an alternate port but is now a designated port. SW2’s Gi1/0/3 port has changed from a designated port to an alternate port.
Example 3-4 Modifying STP Port Cost
SW3# conf t SW3(config)# interface gi1/0/1 SW3(config-if)# spanning-tree cost 1
SW3# show spanning-tree vlan 1 ! Output omitted for brevity VLAN0001 Root ID Priority 32769 Address 0062.ec9d.c500 Cost 1 Port 1 (GigabitEthernet1/0/1) Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 189c.5d11.9980 .. Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Root FWD 1 128.1 P2p Gi1/0/2 Desg FWD 4 128.2 P2p Gi1/0/5 Desg FWD 4 128.5 P2p
SW2# show spanning-tree vlan 1 ! Output omitted for brevity VLAN0001 Root ID Priority 32769 Address 0062.ec9d.c500 Cost 4 Port 1 (GigabitEthernet1/0/1) Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 0081.c4ff.8b00 .. Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Root FWD 4 128.1 P2p Gi1/0/3 Altn BLK 4 128.3 P2p Gi1/0/4 Desg FWD 4 128.4 P2p
Modifying STP Port Priority
The STP port priority impacts which port is an alternate port when multiple links are used between switches. In our test topology, shutting down the link between SW3 and SW5 forces SW5 to choose one of the links connected to SW4 as a root port.
Example 3-5 verifies that this change makes SW5’s Gi1/0/4 the root port (RP) toward SW4. Remember that system ID and port cost are the same, so the next check is port priority, followed by the port number. Both the port priority and port number are controlled by the upstream switch.
Example 3-5 Viewing STP Port Priority
SW5# show spanning-tree vlan 1 ! Output omitted for brevity VLAN0001 Spanning tree enabled protocol rstp Root ID Priority 32769 Address 0062.ec9d.c500 Cost 12 Port 4 (GigabitEthernet1/0/4) Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address bc67.1c5c.9300 .. Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/4 Root FWD 4 128.4 P2p Gi1/0/5 Altn BLK 4 128.5 P2p
You can modify the port priority on SW4’s Gi1/0/6 (toward R5’s Gi1/0/5 interface) with the command spanning-tree [vlan vlan-id] port-priority priority. The optional vlan keyword allows you to change the priority on a VLAN-by-VLAN basis. Example 3-6 shows how to change the port priority on SW4’s Gi1/0/6 port to 64.
Example 3-6 Verifying Port Priority Impact on an STP Topology
SW4# configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW4(config)# interface gi1/0/6 SW4(config-if)# spanning-tree port-priority 6
Now SW4’s Gi1/0/6 port has a value of 64, which is lower than the value of its Gi1/0/5 port, which is using a default value of 128. SW4’s Gi1/0/6 interface is now preferred and will impact the RP on SW5, as displayed in Example 3-7.
Example 3-7 Determining the Impact of Port Priority on a Topology
SW4# show spanning-tree vlan 1 ! Output omitted for brevity Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/2 Root FWD 4 128.2 P2p Gi1/0/5 Desg FWD 4 128.5 P2p Gi1/0/6 Desg FWD 4 64.6 P2p
SW5# show spanning-tree vlan 1 ! Output omitted for brevity Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/4 Altn BLK 4 128.4 P2p Gi1/0/5 Root FWD 4 128.5 P2p
Additional STP Protection Mechanisms
Network packets do not decrement the time-to-live portion of the header as a packet is forwarded in a Layer 2 topology. A network forwarding loop occurs when the logical topology allows for multiple active paths between two devices. Broadcast and multicast traffic wreak havoc as they are forwarded out of every switch port and continue the forwarding loop. High CPU consumption and low free memory space are common symptoms of a Layer 2 forwarding loop. In Layer 2 forwarding loops, in addition to constantly consuming switch bandwidth, the CPU spikes. Because the packet is received on a different interface, the switch must move the media access control (MAC) address from one interface to the next. The network throughput is impacted drastically; users are likely to notice a slowdown on their network applications, and the switches might crash due to exhausted CPU and memory resources.
The following are some common scenarios for Layer 2 forwarding loops:
STP disabled on a switch
A misconfigured load balancer that transmits traffic out multiple ports with the same MAC address
A misconfigured virtual switch that bridges two physical ports (Virtual switchestypically do not participate in STP.)
End users using a dumb network switch or hub
Catalyst switches detect a MAC address that is flapping between interfaces and notify via syslog with the MAC address of the host, VLAN, and ports between which the MAC address is flapping. These messages should be investigated to ensure that a forwarding loop does not exist. Example 3-8 shows a sample syslog message for a flapping MAC address where STP has been removed from the topology.
Example 3-8 Syslog Message for a Flapping MAC Address
12:40:30.044: %SW_MATM-4-MACFLAP_NOTIF: Host 70df.2f22.b8c7 in vlan 1 is flapping between port Gi1/0/3 and port Gi1/0/2
In this scenario, STP should be checked for all the switches hosting the VLAN mentioned in the syslog message to ensure that spanning tree is enabled and working properly.
Root Guard
Root guard is an STP feature that is enabled on a port-by-port basis; it prevents a configured port from becoming a root port. Root guard prevents a downstream switch (often misconfigured or rogue) from becoming a root bridge in a topology. Root guard functions by placing a port in an ErrDisabled state if a superior BPDU is received on a configured port. This prevents the configured DP with root guard from becoming an RP.
Root guard is enabled with the interface command spanning-tree guard root. Root guard is placed on designated ports toward other switches that should never become root bridges.
In the sample topology shown in Figure 3-1, root guard should be placed on SW2’s Gi1/0/4 port toward SW4 and on SW3’s Gi1/0/5 port toward SW5. This prevents SW4 and SW5 from ever becoming root bridges but still allows for SW2 to maintain connectivity to SW1 via SW3 if the link connecting SW1 to SW2 fails.
STP Portfast
The generation of TCN for hosts does not make sense as a host generally has only one connection to the network. Restricting TCN creation to only ports that connect with other switches and network devices increases the L2 network’s stability and efficiency. The STP portfast feature disables TCN generation for access ports.
Another major benefit of the STP portfast feature is that the access ports bypass the earlier 802.1D STP states (learning and listening) and forward traffic immediately. This is beneficial in environments where computers use Dynamic Host Configuration Protocol (DHCP) or Preboot Execution Environment (PXE). If a BPDU is received on a portfast-enabled port, the portfast functionality is removed from that port.
The portfast feature is enabled on a specific access port with the command spanning-tree portfast or globally on all access ports with the command spanning-tree portfast default. If portfast needs to be disabled on a specific port when using the global configuration, you can use the interface configuration command spanning-tree portfast disable to remove portfast on that port.
Portfast can be enabled on trunk links with the command spanning-tree portfast trunk. However, this command should be used only with ports that are connecting to a single host (such as a server with only one NIC that is running a hypervisor with VMs on different VLANs). Running this command on interfaces connected to other switches, bridges, and so on can result in a bridging loop.
Example 3-9 shows how to enable portfast for SW1’s Gi1/0/13 port. Then the configuration is verified by examining the STP for VLAN 10 or examining the STP interface. Notice that the portfast ports are displayed with P2P Edge. The last section of output demonstrates how portfast is enabled globally for all access ports.
Example 3-9 Enabling STP Portfast on Specific Interfaces
SW1(config)# interface gigabitEthernet 1/0/13 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 10 SW1(config-if)# spanning-tree portfast
SW1# show spanning-tree vlan 10 ! Output omitted for brevity VLAN0010 Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/2 Desg FWD 4 128.2 P2p Gi1/0/3 Desg FWD 4 128.3 P2p Gi1/0/13 Desg FWD 4 128.13 P2p Edge
SW1# show spanning-tree interface gi1/0/13 detail
Port 13 (GigabitEthernet1/0/13) of VLAN0010 is designated forwarding
Port path cost 4, Port priority 128, Port Identifier 128.7.
Designated root has priority 32778, address 0062.ec9d.c500
Designated bridge has priority 32778, address 0062.ec9d.c500
Designated port id is 128.7, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
The port is in the portfast mode
Link type is point-to-point by default
BPDU: sent 23103, received
Example 3-10 shows how to enable portfast globally for all access ports on SW2 and then disable it for Gi1/0/8.
Example 3-10 Enabling STP Portfast Globally
SW2# conf t Enter configuration commands, one per line. End with CNTL/Z. SW2(config)# spanning-tree portfast default %Warning: this command enables portfast by default on all interfaces. You should now disable portfast explicitly on switched ports leading to hubs, switches and bridges as they may create temporary bridging loops. SW2(config)# interface gi1/0/8 SW2(config-if)# spanning-tree portfast disabl
BPDU Guard
BPDU guard is a safety mechanism that shuts down ports configured with STP portfast upon receipt of a BPDU. Assuming that all access ports have portfast enabled, this ensures that a loop cannot accidentally be created if an unauthorized switch is added to a topology.
BPDU guard is enabled globally on all STP portfast ports with the command spanning-tree portfast bpduguard default. BPDU guard can be enabled or disabled on a specific interface with the command spanning-tree bpduguard {enable | disable}.
Example 3-11 shows how to configure BPDU guard globally on SW1 for all access ports but with the exception of disabling BPDU guard on Gi1/0/8. The show spanning-tree interface interface-id detail command displays whether BPDU guard is enabled for the specified port.
Example 3-11 Configuring BPDU Guard
SW1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW1(config)# spanning-tree portfast bpduguard default SW1(config)# interface gi1/0/8 SW1(config-if)# spanning-tree bpduguard disable
SW1# show spanning-tree interface gi1/0/7 detail Port 7 (GigabitEthernet1/0/7) of VLAN0010 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.7. Designated root has priority 32778, address 0062.ec9d.c500 Designated bridge has priority 32778, address 0062.ec9d.c500 Designated port id is 128.7, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 The port is in the portfast mode Link type is point-to-point by default Bpdu guard is enabled by default BPDU: sent 23386, received 0 SW1# show spanning-tree interface gi1/0/8 detail Port 8 (GigabitEthernet1/0/8) of VLAN0010 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.8. Designated root has priority 32778, address 0062.ec9d.c500 Designated bridge has priority 32778, address 0062.ec9d.c500 Designated port id is 128.8, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 The port is in the portfast mode by default Link type is point-to-point by default BPDU: sent 23388, received 0
Example 3-12 shows the syslog messages that appear when a BPDU is received on a BPDU guard–enabled port. The port is then placed into an ErrDisabled state, as shown with the command show interfaces status.
Example 3-12 Detecting a BPDU on a BPDU Guard–Enabled Port
12:47:02.069: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gigabit Ethernet1/0/2 with BPDU Guard enabled. Disabling port. 12:47:02.076: %PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/2, putting Gi1/0/2 in err-disable state 12:47:03.079: %LINEPROTO-5-UPDOWN: Line protocol on Interface Gigabit Ethernet1/0/2, changed state to down 12:47:04.082: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/2, changed state to down
SW1# show interfaces status
Port Name Status Vlan Duplex Speed Type
Gi1/0/1 notconnect 1 auto auto 10/100/1000BaseTX
Gi1/0/2 SW2 Gi1/0/1 err-disabled 1 auto auto 10/100/1000BaseTX
Gi1/0/3 SW3 Gi1/0/1 connected trunk a-full a-1000 10/100/1000BaseT
By default, ports that are put in the ErrDisabled state because of BPDU guard do not automatically restore themselves. The Error Recovery service can be used to reactivate ports that are shut down for a specific problem, thereby reducing administrative overhead. To use Error Recovery to recover ports that were shut down from BPDU guard, use the command errdisable recovery cause bpduguard. The period that the Error Recovery checks for ports is configured with the command errdisable recovery interval time-seconds.
Example 3-13 demonstrates the configuration of the Error Recovery service for BPDU guard, verification of the Error Recovery service for BPDU guard, and the syslog messages from the process.
Example 3-13 Configuring Error Recovery Service
SW1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW1(config)# errdisable recovery cause bpduguard
SW1# show errdisable recovery ! Output omitted for brevity ErrDisable Reason Timer Status ----------------- -------------- arp-inspection Disabled bpduguard Enabled .. Recovery command: "clear Disabled Timer interval: 300 seconds Interfaces that will be enabled at the next timeout: Interface Errdisable reason Time left(sec) --------- ----------------- -------------- Gi1/0/2 bpduguard 295
! Syslog output from BPDU recovery. The port will be recovered, and then ! triggered again because the port is still receiving BPDUs. SW1# 01:02:08.122: %PM-4-ERR_RECOVER: Attempting to recover from bpduguard err-disable state on Gi1/0/2 01:02:10.699: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gigabit Ethernet1/0/2 with BPDU Guard enabled. Disabling port. 01:02:10.699: %PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/2, putting Gi1/0/2 in err-disable state
BPDU Filter
BPDU filter simply blocks BPDUs from being transmitted out a port. BPDU filter can be enabled globally or on a specific interface. The behavior changes depending on the configuration:
The global BPDU filter configuration uses the command spanning-tree portfast bpdufilter default, and the port sends a series of 10 to 12 BPDUs. If the switch receives any BPDUs, it checks to identify which switch is more preferred.
The preferred switch does not process any BPDUs that it receives, but it still transmits BPDUs to inferior downstream switches.
A switch that is not the preferred switch processes BPDUs that are received, but it does not transmit BPDUs to the superior upstream switch.
The interface-specific BPDU filter is enabled with the interface configuration command spanning-tree bpdufilter enable. The port does not send any BPDUs on an ongoing basis. If the remote port has BPDU guard on it, that generally shuts down the port as a loop prevention mechanism.
Example 3-14 shows SW1’s Gi1/0/2 statistics after BPDU is enabled on the Gi1/0/2 interface. In the first set of output, BPDU filter is enabled specifically on the Gi1/0/2 interface (thereby prohibiting any BPDUs from being sent or received). The second set of output enables BPDU filtering globally, so that BPDUs are transmitted when the port first becomes active; the filtering is verified by the number of BPDUs sent changing from 56 to 58.
Example 3-14 Verifying a BPDU Filter
! SW1 was enabled with BPDU filter only on port Gi1/0/2 SW1# show spanning-tree interface gi1/0/2 detail | in BPDU|Bpdu|Ethernet Port 2 (GigabitEthernet1/0/2) of VLAN0001 is designated forwarding Bpdu filter is enabled BPDU: sent 113, received 84 SW1# show spanning-tree interface gi1/0/2 detail | in BPDU|Bpdu|Ethernet Port 2 (GigabitEthernet1/0/2) of VLAN0001 is designated forwarding Bpdu filter is enabled BPDU: sent 113, received 84
! SW1 was enabled with BPDU filter globally SW2# show spanning-tree interface gi1/0/2 detail | in BPDU|Bpdu|Ethernet Port 1 (GigabitEthernet1/0/2) of VLAN0001 is designated forwarding BPDU: sent 56, received 5 SW2# show spanning-tree interface gi1/0/2 detail | in BPDU|Bpdu|Ethernet Port 1 (GigabitEthernet1/0/2) of VLAN0001 is designated forwarding BPDU: sent 58, received
Problems with Unidirectional Links
Fiber-optic cables consist of strands of glass/plastic that transmit light. A cable typically consists of one strand for sending data and another strand for receiving data on one side; the order is directly opposite at the remote site. Network devices that use fiber for connectivity can encounter unidirectional traffic flows if one strand is broken. In such scenarios, the interface still shows a line-protocol up state; however, BPDUs are not able to be transmitted, and the downstream switch eventually times out the existing root port and identifies a different port as the root port. Traffic is then received on the new root port and forwarded out the strand that is still working, thereby creating a forwarding loop.
A couple solutions can resolve this scenario:
STP loop guard
Unidirectional Link Detection
STP Loop Guard
STP loop guard prevents any alternative or root ports from becoming designated ports (ports toward downstream switches) due to loss of BPDUs on the root port. Loop guard places the original port in an ErrDisabled state while BPDUs are not being received. When BPDU transmission starts again on that interface, the port recovers and begins to transition through the STP states again.
Loop guard is enabled globally by using the command spanning-tree loopguard default, or it can be enabled on an interface basis with the interface command spanning-tree guard loop. It is important to note that loop guard should not be enabled on portfast-enabled ports (because it directly conflicts with the root/alternate port logic).
Example 3-15 demonstrates the configuration of loop guard on SW2’s Gi1/0/1 port.
Example 3-15 Configuring Loop Guard
SW2# config t
SW2(config)# interface gi1/0/1
SW2(config-if)# spanning-tree guard loop
! Placing BPDU filter on SW2's RP (Gi1/0/1) bridge) triggers loop guard.
SW2(config-if)# interface gi1/0/1
SW2(config-if)# spanning-tree bpdufilter enabled
01:42:35.051: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port Gigabit
Ethernet1/0/1 on VLAN0001
SW2# show spanning-tree vlan 1 | b Interface Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------- Gi1/0/1 Root BKN*4 128.1 P2p *LOOP_Inc Gi1/0/3 Root FWD 4 128.3 P2p Gi1/0/4 Desg FWD 4 128.4 P2
At this point, the port is considered to be in an inconsistent state and does not forward any traffic. Inconsistent ports are viewed with the command show spanning-tree inconsistentports, as show in Example 3-16. Notice that an entry exists for all the VLANs carried across the Gi1/0/1 port.
Example 3-16 Viewing the Inconsistent STP Ports
SW2# show spanning-tree inconsistentports Name Interface Inconsistency -------------------- ------------------------ ------------------ VLAN0001 GigabitEthernet1/0/1 Loop Inconsistent VLAN0010 GigabitEthernet1/0/1 Loop Inconsistent VLAN0020 GigabitEthernet1/0/1 Loop Inconsistent VLAN0099 GigabitEthernet1/0/1 Loop Inconsistent Number of inconsistent ports (segments) in the system : 4
Unidirectional Link Detection
Unidirectional Link Detection (UDLD) allows for the bidirectional monitoring of fiber-optic cables. UDLD operates by transmitting UDLD packets to a neighbor device that includes the system ID and port ID of the interface transmitting the UDLD packet. The receiving device then repeats that information, including its system ID and port ID, back to the originating device. The process continues indefinitely. UDLD operates in two different modes:
Normal: In normal mode, if a frame is not acknowledged, the link is considered undetermined and the port remains active.
Aggressive: In aggressive mode, when a frame is not acknowledged, the switch sends another eight packets in 1-second intervals. If those packets are not acknowledged, the port is placed into an error state.
UDLD is enabled globally with the command udld enable [aggressive]. This enables UDLD on any small form-factor pluggable (SFP)-based port. UDLD can be disabled on a specific port with the interface configuration command udld port disable. UDLD recovery can be enabled with the command udld recovery [interval time], where the optional interval keyword allows for the timer to be modified from the default value of 5 minutes. UDLD can be enabled on a port-by-port basis with the interface configuration command udld port [aggressive], where the optional aggressive keyword places the ports in UDLD aggressive mode.
Example 3-17 shows how to enable UDLD normal mode on SW1.
Example 3-17 Configuring UDLD
SW1# conf t Enter configuration commands, one per line. End with CNTL/Z. SW1(config)# udld enabl
UDLD must be enabled on the remote switch as well. Once it is configured, the status of UDLD neighborship can be verified with the command show udld neighbors. More detailed information can be viewed with the command show udld interface-id.
Example 3-18 displays the verification of SW1’s neighborship with SW2. The link is operating in a bidirectional state. More information is obtained with the show udld Te1/1/3 command, which includes the current state, device IDs (that is, serial numbers), originating interface IDs, and return interface IDs.
Example 3-18 Verifying UDLD Neighbors and Switch Port Status
SW1# show udld neighbors
Port Device Name Device ID Port ID Neighbor State
---- ----------- --------- ------- --------------
Te1/1/3 081C4FF8B0 1 Te1/1/3 Bidirectional
SW1# show udld Te1/1/3 Interface Te1/1/3 --- Port enable administrative configuration setting: Follows device default Port enable operational state: Enabled Current bidirectional state: Bidirectional Current operational state: Advertisement - Single neighbor detected Message interval: 15000 ms Time out interval: 5000 ms Port fast-hello configuration setting: Disabled Port fast-hello interval: 0 ms Port fast-hello operational state: Disabled Neighbor fast-hello configuration setting: Disabled Neighbor fast-hello interval: Unknown Entry 1 --- Expiration time: 41300 ms Cache Device index: 1 Current neighbor state: Bidirectional Device ID: 081C4FF8B0 Port ID: Te1/1/3 Neighbor echo 1 device: 062EC9DC50 Neighbor echo 1 port: Te1/1/3 TLV Message interval: 15 sec No TLV fast-hello interval TLV Time out interval: 5 TLV CDP Device name: SW2
Exam Preparation Tasks
As mentioned in the section “How to Use This Book” in the Introduction, you have a couple of choices for exam preparation: the exercises here, Chapter 30, “Final Preparation,” and the exam simulation questions in the Pearson Test Prep Software Online.
Review All Key Topics
Review the most important topics in the chapter, noted with the Key Topic icon in the outer margin of the page. Table 3-2 lists these key topics and the page number on which each is found.
Table 3-2 Key Topics for Chapter 3
Key Topic Element |
Description |
Page |
Section |
Root bridge placement |
|
Paragraph |
Root bridge values |
|
Paragraph |
Spanning tree port cost |
|
Section |
Root guard |
|
Section |
STP portfast |
|
Section |
BPDU guard |
|
Section |
BPDU filter |
Complete Tables and Lists from Memory
There are no memory tables in this chapter.
Define Key Terms
Define the following key terms from this chapter and check your answers in the Glossary:
Use the Command Reference to Check Your Memory
Table 3-3 lists the important commands from this chapter. To test your memory, cover the right side of the table with a piece of paper, read the description on the left side, and see how much of the command you can remember.
Table 3-3 Command Reference
Task |
Command Syntax |
Configure the STP priority for a switch so that it is a root bridge or a backup root bridge |
spanning-tree vlan vlan-id root {primary | secondary} [diameter diameter] OR spanning-tree vlan vlan-id priority priority |
Configure the STP port cost |
spanning tree [vlan vlan-id] cost cost |
Configure the STP port priority on the downstream port |
spanning-tree [vlan vlan-id] port-priority priority |
Enable root guard on an interface |
spanning-tree guard root |
Enable STP portfast globally, for a specific port, or for a trunk port |
spanning-tree portfast default OR spanning-tree portfast OR spanning-tree portfast trunk |
Enable BPDU guard globally or for a specific switch port |
spanning-tree portfast bpduguard default OR spanning-tree bpduguard {enable | disable} |
Enable BPDU guard globally or for a specific interface |
spanning-tree portfast bpdufilter default OR spanning-tree bpdufilter enable |
Enable STP loop guard globally or for a specific interface |
spanning-tree loopguard default OR spanning-tree guard loop |
Enable automatic error recovery for BPDU guard. |
errdisable recovery cause bpduguard |
Change the automatic error recovery time |
errdisable recovery interval time-seconds |
Enable UDLD globally or for a specific port |
udld enable [aggressive] OR udld port [aggressive] |
Display the list of STP ports in an inconsistent state |
show spanning-tree inconsistentports |
Display the list of neighbor devices running UDLD |
show udld neighbors |