Users Guide

Spanning-tree extensions
STP extensions provide a means to ensure ecient network convergence by securely enforcing the active network topology. OS10
supports BPDU ltering, BPDU guard, root guard, and loop guard STP extensions.
The system discards regular data trac after a BPDU violation.
BPDU ltering Protects the network from unexpected ooding of BPDUs from an erroneous device. Enabling BPDU Filtering on
an interface causes the system to send or receive BPDUs.
BPDU guard Blocks the L2 bridged ports and LAG ports connected to end hosts and servers from receiving any BPDUs. When
you enable BPDU guard, it places the bridge or LAG port in the Error_Disable or Blocking state if the port receives
any BPDU frames. In case of a LAG, all member ports, are placed in the Blocking state. The data trac is dropped
but the port continues to forward BPDUs to the CPU that are later dropped. To prevent further reception of
BPDUs, congure a port to shut down using the
violation action command. For more information on STP
commands, see STP Commands.
Root guard Avoids bridging loops and preserves the root bridge position during network transitions. STP selects the root bridge
with the lowest priority value. During network transitions, another bridge with a lower priority may attempt to
become the root bridge and cause unpredictable network behavior. To avoid such an attempt and preserve the
position of the root bridge, congure the spanning-tree guard root command. Root guard is enabled on
ports that are designated ports. The root guard conguration applies to all VLANs congured on the port.
Loop guard Prevents L2 forwarding loops caused by a cable or interface hardware failure. When a hardware failure occurs, a
participating spanning-tree link becomes unidirectional and a port stops receiving BPDUs. When a blocked port
stops receiving BPDUs, it transitions to a Forwarding state causing spanning-tree loops in the network. Enable loop
guard on a port that transitions to the Loop-Inconsistent state until it receives BPDUs using the spanning-tree
guard loop command. After BPDUs are received, the port moves out of the Loop-Inconsistent or blocking state
and transitions to an appropriate state determined by STP. Enabling loop guard on a per-port basis enables it on all
VLANs congured on the port. If you disable loop guard on a port, it moves to the Listening state.
NOTE:
1 Root guard and Loop guard are mutually exclusive.
2 Conguring one overwrites the other from the active conguration.
1 Enable spanning-tree BPDU lter in INTERFACE mode.
spanning-tree bpdufilter enable
2 Enable STP BPDU guard in INTERFACE mode.
spanning-tree bpduguard enable
BPDU guard violation causes the system to perform the following actions:
• Shuts down the port channel interface and all member ports are disabled in the hardware.
• Adds the physical port to a port-channel already in the Error_Disable state; also, the new member port is disabled in the hardware.
• Removes a physical port from a port-channel in Error Disable state. After removing the physical port from the port channel, the
system clears the Error_Disabled state on the physical port and it is enabled in the hardware.
To clear the Error Disabled state:
• Use the shutdown command on the interface.
• Use the spanning-tree bpduguard disable command to disable the BPDU guard on the interface.
• Use the spanning-tree disable command to disable STP on the interface.
3 Set the guard types to avoid loops in INTERFACE mode.
spanning-tree guard {loop | root | none}
• loop — Set the guard type to loop.
Layer 2
395