Reference Guide

BPDU guard Blocks the L2 bridged ports and LAG ports connected to end hosts and servers from receiving any
BPDUs. When you enable BPDU guard, it places a port (bridge or LAG) in the Error_Disable or Blocking
state if the port receives any BPDU frames. In a LAG, all member ports (including new members) are
placed in the Blocking state. The network traffic drops but the port continues to forward BPDUs to
the CPU that are later dropped. To prevent further reception of BPDUs, configure a port to shut down
using the shutdown command. The port can only resume operation from Shutdown state after manual
intervention.
Root guard Avoids bridging loops and preserves the root bridge position during network transitions. STP selects
the root bridge with the lowest priority value. During network transitions, another bridge with a lower
priority may attempt to become the root bridge and cause unpredictable network behavior. Configure
the spanning-tree guard root command to avoid such an attempt and preserve the position of
the root bridge. Root guard is enabled on ports that are designated ports. The root guard configuration
applies to all VLANs configured on the port.
Loop guard Prevents L2 forwarding loops caused by a hardware failure (cable failure or an interface fault). When
a hardware failure occurs, a participating spanning tree link becomes unidirectional and a port stops
receiving BPDUs. When a blocked port stops receiving BPDUs, it transitions to a Forwarding state
causing spanning tree loops in the network. Enable loop guard on a port that transitions to the Loop-
Inconsistent state until it receives BPDUs using the spanning-tree guard loop command. After
BPDUs are received, the port moves out of the Loop-Inconsistent (or blocking) state and transitions to
an appropriate state determined by STP. Enabling loop guard on a per-port basis enables it on all VLANs
configured on the port. If you disable loop guard on a port, it moves to the Listening state.
If you enable BPDU Filter and BPDU Guard on the same port, the BPDU Filter configuration takes precedence. Root Guard and
Loop Guard are mutually exclusive. Configuring one overwrites the other from the active configuration.
1. Enable spanning-tree BPDU filter in INTERFACE mode.
spanning-tree bpdufilter enable
● To shut down the port channel interface, all member ports are disabled in the hardware.
● To add a physical port to a port-channel already in the Error Disable state, the new member port is also disabled in the
hardware.
● To remove a physical port from a port-channel in Error Disable state, the Error Disabled state clears on this physical port
(the physical port is enabled in the hardware).
To clear Error Disabled state:
● Use the shutdown command on the interface.
● Use the spanning-tree bpdufilter disable command to disable the BPDU guard on the interface.
● Use the spanning-tree disable command to disable STP on the interface.
2. Enable STP BPDU guard in INTERFACE mode.
spanning-tree bpduguard enable
● To shut down the port channel interface, all member ports are disabled in the hardware.
● To add a physical port to a port-channel already in the Error Disable state, the new member port is also disabled in the
hardware.
● To remove a physical port from a port-channel in Error Disable state, the Error Disabled state clears on this physical port
(the physical port is enabled in the hardware).
To clear Error Disabled state:
● Use the shutdown command on the interface.
● Use the spanning-tree bpduguard disable command to disable the BPDU guard on the interface.
● Use the spanning-tree disable command to disable STP on the interface.
3. Set the guard types to avoid loops in INTERFACE mode.
spanning-tree guard {loop | root | none}
● loop — Set the guard type to loop.
● none — Set the guard type to none.
● root — Set the guard type to root.
202
Layer 2