Cisco STP Guard

STP guard

 當”foreign or rogue” switch(未經授權的交換設備) is connected to the STP network
 該switch可能會變成root bridge,而造成未預期的stp拓樸,使網路發生變動
 Root Guard
 BPDU Guard

防止sudden loss of BPDUs

方法為bpdu filtering


Root Guard
不允許designated port出現新的root bridge
If another switch advertises a superior BPDU, or one with a better bridge ID on “Root Guard port”
the local switch will 視為異常

當某個designated port發現switch變成root bridge,作業如下
1. the port that receive superior BPDU will be kept in the root-inconsistent STP state
2. No data can be sent or received in that state, but the switch can listen to BPDUs received on the port to detect a new root advertising itself
%SPANTREE-2-ROOTGUARDBLOCK: Port 1/1 tried to become non-designated in VLAN 2. Moved to root-inconsistent state
Root Guard affects the entire port so that a root bridge never can be allowed on any VLAN on the port.
When a superior BPDU is heard on the port, the entire port, in effect, becomes blocked

When the superior BPDUs no longer are received, the port is cycled through the normal STP states to return to normal use

enable Root Guard
Switch(config-if)# spanning-tree guard root
by default, it is disabled on all switch ports
建議使用的介面:never expect to find the root bridge for a VLAN

display about root-inconsistent state
# show spanning-tree inconsistentports

Look for detailed reasons for inconsistencies.
# show spanning-tree interface < interface > [detail]


bpdu Guard

Suppose that a switch is connected by mistake to a port where PortFast is enabled.
1. Now there is a potential for a bridging loop to form.
2. the newly connected device to advertise itself and become the new root bridge

發生異常時(bpdu guard介面收到bpdu時)
If any BPDU received on a port where BPDU Guard is enabled, that port immediately is put into the errdisable state
bpdu guard介面不再收到bpdu時,the port still remains in the errdisable state

Naturally, BPDU Guard does not prevent a bridging loop from forming if an Ethernet hub
is connected to the PortFast port. This is because a hub doesn’t transmit BPDUs itself
a loop can be detected only in a finite amount of time-the length of time required to move the port through the normal STP state

將所有portfast介面啟用bpdu Guard
Switch(config)# spanning-tree portfast bpduguard default
By default, BPDU Guard is disabled
建議在所有STP PortFast介面啟用
never should enable BPDU Guard on any switch uplink where the root bridge is located
enable bpdu Guard on a per-port basis
Switch(config-if)# [no] spanning-tree bpduguard enable

Display the global BPDU Guard status
# show spanning-tree summary [total]


Loop Guard
keeps track of the BPDU activity on nondesignated ports(避免Bloack Port成為Forwarding status而導致Loop)
只運作在nondesignated role(root port,block port)

當blocking port沒收到bpdu一直到maxage timer後,會認為沒有連接到stp設備,因此就會離開blocking status,並根據stp規則會轉變為forwarding status

發生異常時(BPDUs go missing and link is up)
Loop Guard moves the port into the loop-inconsistent state
The port is effectively blocking at this point to prevent a loop from forming and to keep it in the nondesignated role
ps: blocking action is taken on a per-VLAN basis ,so Loop Guard doesn’t block the entire port

恢復正常時(BPDUs are received on the port again and link is up)
Loop Guard allows the port to move through the normal STP states and become active

enable Loop Guard as a global default
Switch(config)# spanning-tree loopguard default
enable Loop Guard on a specific switch port
Switch(config-if)# [no] spanning-tree guard loop
By default, Loop Guard is disabled
(config-if)#switch mode trunk不會干擾loop guard
Access ports不會收到BPDUs,若LoopGuard設在access ports,則會一直保持Loop Inconsistent mode並block the port

Display the Loop Guard states.
# show spanning-tree summary


UDLD(Unidirectional Link Detection)
interactively monitors a port to see whether the link is truly bidirectional
ps:It is recommended that it be used with the “loop guard” feature

unidirectional link問題
if just one side of the link (receive or transmit) had an odd failure, such as malfunctioning transmit circuitry in a GBIC or SFP modules?
In some cases, the two switches still might see a functional bidirectional link, although traffic actually would be delivered in only one direction. This is known as a unidirectional link
ex:switch1可把packet傳給neighbor switch2,但switch2傳的packet無法被switch1收到 
Twisted-pair or copper media does not suffer from the physical layer conditions that allow a unidirectional link to form
此情況發生時,在兩邊使用show cdp會發現,只有一邊看的到對方

unidirectional link的危險
A unidirectional link poses a potential danger to STP topologies because BPDUs will not be received on one end of the link. If that end of the link normally would be in the Blocking state, it will not be that way for long. A switch interprets the absence of BPDUs to mean that the port can be moved safely through the STP states so that traffic can be forwarded.
However, if that is done on a unidirectional link, a bridging loop forms and the switch never realizes the mistake

A switch sends special Layer 2 UDLD frames identifying its switch port at regular intervals(The default is 15 sec)
Destination MAC為0100:0CCC:CCCC
UDLD expects the far-end switch to echo those frames back across the same link, with the far-end switch port’s identification added
If a UDLD frame is received in return and both neighboring ports are identified in the frame, the link must be bidirectional

if the echoed frames are not seen, the link must be unidirectional for some reason
Normal mode :
the port is allowed to continue its operation.
UDLD merely marks the port as having an undetermined state and generates a syslog message
aggressive mode(recommended)
the switch takes action to reestablish the link.
UDLD messages are sent out once a second for 8 seconds.
If none of those messages is echoed back, the port is placed in the Errdisable state so that it cannot be used

需在blocked port into the Forwarding state之前檢測到unidirectional link condition
the target time must < “the Max Age timer + two intervals of the Forward Delay timer”, ( default is 50 seconds)
檢測unidirectional link時間不超過 3 times the UDLD message interval (default 45sec total).

UDLD has no record of any neighbor on the link.
It starts sending out messages,
case1:the neighboring switch also support UDLD
a neighboring switch will hear them and echo them back
case2:the neighboring switch does not yet have UDLD enabled
UDLD will
 1. keep trying (indefinitely) to detect a neighbor
 2. not disable the link
After the neighbor has UDLD configured also,
a neighboring switch will hear them and echo them back
both switches become aware of each other and the bidirectional state of the link through their UDLD message exchanges
if messages are not echoed, the link can accurately be labeled as unidirectional
This becomes important in an EtherChannel:
If one link within the channel becomes unidirectional, UDLD flags or disables only the offending link in the bundle,not the entire EtherChannel. UDLD sends and echoes its messages on each link within an EtherChannel channel independently

(config)# udld < enable | aggressive>
By default,UDLD is disabled on all switch ports
enables UDLD only on ports that use fiber-optic media
enable: 預設,使用normal mode
aggressive: 使用aggressive mode
(config-if)# udld < enable | aggressive | disable>
建議以global啟動方式代替individual port啟動
an echo process such as this requires both ends of the link to be configured for UDLD . Otherwise, one end of the link will not echo the frames back to the originator

設定udld time intervals
(config)# udld message time < seconds>
ps:Catalyst 3550 default is 7 sec; Catalyst 4500/6500 default is 15 seconds

Display the UDLD status on one or all ports.
# show udld < interface>

Reenable ports that UDLD aggressive mode has errdisabled.
# udld reset


BPDU Filtering
to prevent BPDUs from being sent or processed on one or more switch ports
disable STP on those ports
Enable BPDU filtering only if the connected device cannot allow BPDUs to be accepted or sent. Otherwise, you should permit STP to operate on the switch ports as a precaution.

將所有portfast介面啟用bpdu filtering
(config)# spanning-tree portfast bpdufilter < default | enable >
default:當portfast介面收到bpdu時,該介面portfast會被關閉並enable stp  
If PortFast is disabled on a port, then BPDU filtering will not be enabled there
By default, BPDU filtering is disabled on all switch ports
you are absolutely sure that a switch port will have a single host connected and that a loop will be impossible
enable(or disable) bpdu filtering on a per-port basis
(config-if)# spanning-tree bpdufilter < enable | disable>

Display the BPDU filter states
# show spanning-tree summary [ total]