Administrator Guide

loopguard Enter the keyword loopguard to enable loop guard on a PVST+ port or port-
channel interface.
rootguard Enter the keyword rootguard to enable root guard on a PVST+ port or port-
channel interface.
Defaults Not configured.
Command Modes INTERFACE
Command
History
This guide is platform-specific. For command information about other platforms, see the relevant Dell
Networking OS Command Line Reference Guide.
The following is a list of the Dell Networking OS version history for this command.
Version Description
9.9(0.0) Introduced on the C9010.
9.2(1.0) Introduced on the Z9500.
8.3.19.0 Introduced on the S4820T.
8.3.11.1 Introduced on the Z9000.
8.4.2.1 Introduced the loopguard and rootguard options on the E-Series TeraScale,
C-Series, and S-Series.
8.3.7.0 Introduced on the S4810.
8.2.1.0 Introduced the hardware shutdown-on-violation option.
7.6.1.0 Introduced on the S-Series.
7.5.1.0 Introduced on the C-Series.
7.4.1.0 Added the optional Bridge Port Data Unit (BPDU) guard.
6.2.1.1 Introduced.
Usage
Information
The BPDU guard option prevents the port from participating in an active STP topology in case a BPDU
appears on a port unintentionally, or is misconfigured, or is subject to a DOS attack. This option places the
port into the Error Disable state if a BPDU appears, and a message is logged so that the administrator can
take corrective action.
NOTE: A port configured as an edge port, on a PVST switch, immediately transitions to the
forwarding state. Only ports connected to end-hosts should be configured as an edge port. Consider
an edge port similar to a port with a spanning-tree portfast enabled.
If you do not enable shutdown-on-violation, BPDUs are still sent to the route process module
(RPM) CPU.
You cannot enable root guard and loop guard at the same time on a port. For example, if
you configure loop guard on a port on which root guard is already configured, the following
error message is displayed: % Error: RootGuard is configured. Cannot configure
LoopGuard.
When used in a PVST+ network, loop guard is performed per-port or per-port channel at a VLAN level. If
no BPDUs are received on a VLAN interface, the port or port-channel transitions to a Loop-Inconsistent
(blocking) state only for this VLAN.
Enabling Portfast BPDU guard and loop guard at the same time on a port results in a port that remains
in a Blocking state and prevents traffic from flowing through it. For example, when Portfast BPDU guard
and loop guard are both configured:
● If a BPDU is received from a remote device, BPDU guard places the port in an Err-Disabled Blocking
state and no traffic is forwarded on the port.
● If no BPDU is received from a remote device, loop guard places the port in a Loop-Inconsistent
Blocking state and no traffic is forwarded on the port.
On PE ports and on VP-LAGs (LAGs formed with PE ports)
1280
Per-VLAN Spanning Tree Plus (PVST+)