Help with understanding loop, root and BPDU guard

[trane.m]

Hi,

I'm trying to read up for (and take) the CCNA, so that's the level of depth and understanding i'm seeking.

I (hopefully) understand root guard and BPDU guard to some extend. Please correct me if i'm wrong and provide me with the proper knowledge.

Root guard is to prevent another switch from being root bridge. So if you have SW1 and SW2 connected, with SW1 being root bridge and you connect a SW3 to a SW2 port with BPDU guard enabled, if SW3 then starts to send superior BPDU's, SW2 won't accept SW3 as the new root bridge. That's what i know, but then what? I guess SW2 would somehow inform SW3 that it's not the root bridge, right? But how?

BPDU guard is sort of an extension of Portfast; To prevent a loop from forming, BPDU guard can be enabled on Portfast enabled interfaces, so if the switch receives a BPDU on those interfaces, the interfaces will be shutdown.
But i have a small example with a question:

 Let's say SW3 formerly had a end host connected to it's G0/0 interface and for that reason, also had BPDU guard enabled. Now the IT guy chooses to expand the network with a SW4 connected to SW3's G0/0. SW4 would send BPDUs, SW3 would notice and shutdown the interface. But how is that preventing a loop? Can someone come up with a simple scenario where a loop is prevented?

I'm having trouble understanding loop guard and that might be because i haven't been able to find any explaining examples online. I understand that if an interface with loop guard enabled, stops receiving BPDUs, it will not start forwarding BPDUs, but instead, it will be disabled, but i don't see how that helps.

If someone can explain a scenario where the problem, loop guard is invented to solve, occurs, i would be very thankful.

Thank you in advance

[Flavio Miranda · Accepted solution]

You got everything right.

"That's what i know, but then what? I guess SW2 would somehow inform SW3 that it's not the root bridge, right? But how?"

"If the bridge receives superior STP Bridge Protocol Data Units (BPDUs) on a root guard-enabled port, root guard moves this port to a root-inconsistent STP state. This root-inconsistent state is effectively equal to a listening state. No traffic is forwarded across this port. In this way, the root guard enforces the position of the root bridge. "

About you scenario, a good explanation is here:

" In Figure 2, device D begins to participate in STP. For example, software-based bridge applications are launched on PCs or other switches that a customer connects to a service-provider network. If the priority of bridge D is 0 or any value lower than the priority of the root bridge, device D is elected as a root bridge for this VLAN. If the link between device A and B is 1 gigabit and links between A and C as well as B and C are 100 Mbps, the election of D as root causes the Gigabit Ethernet link that connects the two core switches to block. This block causes all the data in that VLAN to flow via a 100-Mbps link across the access layer. If more data flow via the core in that VLAN than this link can accommodate, the drop of some frames occurs. The frame drop leads to a performance loss or a connectivity outage."

But, the conclusion needs to be that STP is not a good protocol. It was invented far ago and does not fit modern network  requirements and that´s why it is being replaced for Layer 3 loop prevention protocol, which is much more smart.

[Jon Marshall]

It's all a matter of opinion but as far as I am concerned STP is a perfectly good protocol without which modern day LANs would not exist. 

I think an awful lot of network engineers would be surprised to hear it does not fit modern requirements and if you think that try turning it off in most networks and see what happens. 

Jon

[trane.m]

Thanks, but i don't understand your explanation.

[Flavio Miranda]

Which part did you not understand. This information was actually taken from the Cisco docs.

About the topology, it that the case, explain about a performance problem in case the network did not converge properly.

But, you are right about what you said that if you have three switches connected and the forth is connected in one of them, there will be no loop as long as the switch stay connected in one interface only.

[ashishr · Accepted solution]

Hi @trane.m 

Loopguard is similar to UDLD. Let's use your diagram for reference. Assume that Sw-1 is root bridge and the port on Sw-3 towards Sw-2 is blocking port.

        --------[Sw-1]----------

       |                                           |

 RP  |                                           |RP

[Sw-2]DP----------------Blk [Św-3]

If these are all fiber links and if due to some reason there is a unidirectional link failure between Sw-2 and Sw-3 as a result of which BPDU from Sw-2 will not reach Sw-3, in this situation the STP blocking port on Sw-3 transitions to the Listening state when the max_age timer expires, and then it transitions to Forwarding state. This will cause loop in network because there are no blocking ports now.

With loopguard enabled the port moves to loop-inconsistent state which is equal to Blocking port thus preventing loop.

Refer to diagram and comparison with UDLD here-

STP Loop Guard

https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10596-84.html#loop_guard_vs_uld 

Thanks,

Ashish

[trane.m]

Thanks! That made sense! So you could say that loop guard is there to prevent a blocking port from being anything else than a blocking port?