STP LOOP GUARD / UniDirectional Link Detection

• Loop guard is enabled on L-2 interfaces only
• Unidirectional link:
• due to stp unable to receive bpdu packets, but send the packets
• cause, 
• max-age expired
• 2 switches bothe elected disignated port at same time
• Example: In case of optical channels send channel not works but receive channel is working
•  Due to layer-1 issue send channel is not working 
• then BPDUs from SW2 to SW3 not reached
• Blocked port on SW3 automatically Designated port after max-age timer expired
• solution is create L-1 keep alive, that can we send both incoming & outgoing on the same link
• 
  

Functionality	Loop Guard	UDLD
Configuration	Per-port	Per-port
Action granularity	Per-VLAN	Per-port
Autorecover	Yes	Yes, with err-disable timeout feature
Protection against STP failures caused by unidirectional links	Yes, when enabled on all root and alternate ports in redundant topology	Yes, when enabled on all links in redundant topology
Protection against STP failures caused by problems in the software (designated switch does not send BPDU)	Yes	No
Protection against miswiring.	No	Yes

Source: cisco documentation

• Commonly run both loop guard & UDLD run at same time
• spanning-tree loopguard default / spanning-tee guard loop
• UDLD
• udld port 
• udld port aggressive
• 
  

STP ROOT GAURD

• check the incoming BPDU, 
• if supirior BPDU comes, disable that link or close that STP instance(root inconsistant state)
• untill stop receving superior bpdu
• spanning-tree guard root

STP BPDU GUARD

• If BPDU received from end host, immediately shut down the port
• Instead of blocking BPDU(as in BPDU filter)  make the port into error disable state(traffic blocked).
• After port going into error disable state, port can up
• if error disable recovery timer expires
• or, manually shutdown the port then bringsup.
•  It is the more secured implementation of filtering STP.
• Also config with PortFast on global mode
• interface level will over ride global config
• to check error disable recover timer enable or not use show cmd
• show errdisable recvoery
• Enable error disable recovery timer
• errdisable recovery interval 30 on global mode (some times not enabled, verify by above cmd, then use below cmd)
• errdisable recovery cause bpdugaurd because there are so many causes the port goto errdisable state
• spanning-tree portfast bpdugaurd default
• spanning-tree bpdugaurd default

STP BPDU filter

• Filter incoming and outgoing BPDU
• Configure on interface and globally
• disable stp by dropping bpdu packets
• applied at access layer
• to block stp information reaching the end hosts for security pupose
• sh spannig-tree counters 
• disadvantage:
• some times end host sends BPDU(run stp) at that time we can't get that bpdus due to bpdu filter
• If config with portfast on global mode, bpdu filter enable on each port fast containing port.
• and also allow the incoming bpdus, as-usually block the outgoing bpdus
• 
  

BACKBONEFAST

• Not fast as uplinkfast due to link failure at some where else at upstream of root port 
• Indirect failure, start recalculate stp
• i.e. there is a problem at upstream of root port and root bridge is not reachable.
• After a failure of upstream, upstream bridge advertise inferior BPDU(worse cost to root) to root port.
• send Root Link Query(specific for BackBoneFast & ask Do u have alternate path)  
• then root port containing bridge understand there is link failure to reach root bridge,
• and expires max-age time(defaultly 20sec) and recalculate path costs
• when baackbonefast is used time to reconverge is only the listen&learn time only, no max-age
• spanning tree backbonefast on global mode