Preventing STP forwarding loops
The Spanning Tree Protocol is an OSI layer-2 protocol that ensures a loop-free topology for any bridged LAN. Spanning tree allows a network design to include spare (redundant) links to provide automatic backup paths if an active link fails, without the danger of bridge loops, or the need for manual enabling/disabling of these backup links. Bridge loops must be avoided because they result in flooding the network.
The Spanning Tree Protocol (STP), is defined in the IEEE Standard 802.1D. As the name suggests, it creates a spanning tree within a mesh network of connected layer-2 bridges (typically Ethernet switches), and disables those links that are not part of the tree, leaving a single active path between any two network nodes.
But what happens if a switch doesn’t receive BPDU in a timely manner or when it doesn’t receive any? In this case the topology must have changed and blocked ports can be unblocked, so a “logical” loop can occur.
Consider this example in order to illustrate this behavior. Ciscozine1 is the root switch and the fastethernet0/2 of Ciscozine3 is in blocking state. Ciscozine3 does not receive BPDUs from Ciscozine2 due to unidirectional link failure on the link between Ciscozine2 and Ciscozine3.
The STP blocking port on Ciscozine3 transitions to the STP listening state when the max_age timer expires, and then it transitions to the forwarding state in two times the forward_delay time. This situation creates a loop.
To preventing STP forwarding loops, Cisco has implemented two features to detect unexpected BPDU loss: UDLD and loop guard.
Loop guard and Unidirectional Link Detection (UDLD) functionality overlap, partly in the sense that both protect against STP failures caused by unidirectional links. However, these two features differ in functionality and how they approach the problem. This table describes loop guard and UDLD functionality:
|Autorecover||Yes||Yes, with err-disable timeout feature|
|Protection against STP failures caused by unidirectional links||Yes, when enabled on all root and alternate ports in redundant topology||Yes, when enabled on all links in redundant topology|
|Protection against STP failures caused by problems in the software (designated switch does not send BPDU)||Yes||No|
|Protection against miswiring.||No||Yes|
UDLD is a Layer 2 protocol that enables devices connected through fiber-optic or twisted-pair Ethernet cables to monitor the physical configuration of the cables and detect when a unidirectional link exists. All connected devices must support UDLD for the protocol to successfully identify and disable unidirectional links. When UDLD detects a unidirectional link, it administratively shuts down the affected port and alerts you.
UDLD supports two modes: normal (the default) and aggressive. In normal mode, UDLD can detect unidirectional links due to misconnected interfaces on fiber-optic connections. In aggressive mode, UDLD can also detect unidirectional links due to one-way traffic on fiber-optic and twisted-pair links and to misconnected interfaces on fiber-optic links.
Normally UDLD is disabled by default; to enable it:
Enable UDLD globally: aggressive mode (on all fiber-optic interfaces)
Ciscozine3# conf t Ciscozine3(config)# udld aggressive
Enable UDLD globally: normal mode (on all fiber-optic interfaces)
Ciscozine3# conf t Ciscozine3(config)# udld normal
Enable UDLD on a interface: aggressive mode
Ciscozine3# conf t Ciscozine3(config)# interface fastethernet0/2 Ciscozine3(config-if)# udld port aggressive
Enable UDLD on a interface: normal mode
Ciscozine3# conf t Ciscozine3(config)# interface fastethernet0/2 Ciscozine3(config-if)# udld port
To verify the UDLD configuration use the command show udld ?
If UDLD notices an unidirectional link, it shutdown the port. To re-enable it use the command udld reset in the privileged EXEC mode.
- UDLD is not supported on ATM interfaces.
- A UDLD-capable interface also cannot detect a unidirectional link if it is connected to a UDLD-incapable port of another switch.
- When configuring the mode (normal or aggressive), make sure that the same mode is configured on both sides of the link.
The STP loop guard feature provides additional protection against Layer 2 forwarding loops (STP loops). If BPDUs are not received on a non-designated port, and loop guard is enabled, that port is moved into the STP loop-inconsistent blocking state, instead of the listening / learning / forwarding state.
Enable loop guard globally
Ciscozine3# conf t Ciscozine3(config)# spanning-tree loopguard default
Enable loop guard on a interface
Ciscozine3# conf t Ciscozine3(config)# interface fastethernet0/2 Ciscozine3(config-if)# spanning-tree guard loop
Use the command show spanning-tree ? to check if there are ports in a inconsistent state.
REMEMBER: Once the BPDU is received on a port in a loop-inconsistent STP state, the port transitions into another STP state. According to the received BPDU, this means that the recovery is automatic and intervention is not necessary.
- May 2013
- April 2013
- March 2013
- February 2013
- December 2012
- November 2012
- October 2012
- September 2012
- August 2012
- July 2012
- June 2012
- May 2012
- April 2012
- March 2012
- February 2012
- December 2011
- November 2011
- October 2011
- September 2011
- August 2011
- July 2011
- June 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- July 2010
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008