Users Guide

Spanning Tree Protocol 879
If BPDU filtering is configured globally on the switch, the feature is
automatically enabled on all operational PortFast-enabled ports. These ports
are typically connected to hosts that drop BPDUs. However, if an operational
edge port receives a BPDU, the BPDU filtering feature disables PortFast and
allows the port to participate in the spanning tree calculation.
Enabling BPDU filtering on a specific port prevents the port from sending
BPDUs and allows the port to drop any BPDUs it receives.
Root Guard
Root guard is another way of controlling the spanning-tree topology other
than setting the bridge priority or path costs. Root guard ensures that a port
does not become a root port or a blocked port. When a switch is elected as
the root bridge, all ports are assigned roles as designated ports unless two or
more ports of the root bridge are connected in a loop. If the switch receives a
superior STP BPDU on a root-guard enabled port, the root guard feature
moves the port to a root-inconsistent spanning-tree state. No traffic is
forwarded across the port, but it continues to receive BPDUs, discards
received traffic, and is included in the active topology. Essentially, this is
equivalent to the IEEE 802.1D listening state. By not transitioning the port
on which the superior BPDU has been received to the forwarding state
(designated role), root guard helps maintain the existing spanning-tree
topology.
When the STP mode is configured as MSTP, the port may be a designated
port in one MSTI and an alternate port in the CIST, etc. Root guard is a per
port (not a per port instance command) configuration, so all the MSTP
instances this port participates in should not be expected to take on a root
role.
Loop Guard
Loop guard protects a network from forwarding loops induced by BPDU
packet loss. The reasons for failing to receive packets are numerous, including
heavy traffic, software problems, incorrect configuration, and unidirectional
link failure. When a non-designated port no longer receives BPDUs, the
spanning tree algorithm considers the link to be loop free and transitions the
link from blocking to forwarding. Once in the forwarding state, the link may
create a loop in the network.