Table Of Contents
Information About STP Extensions
Applying STP Extension Features
Licensing Requirements for STP Extensions
Prerequisites for STP Extensions
Setting Default Values for STP Extensions
Setting STP Extensions Globally
Configuring PVST Simulation Globally
Setting STP Extensions Per Interface
Field Descriptions for Configuring STP Extensions
Device: Configuration: Global Setting Section
Device: Configuration: Port Setting Section
Configuring STP Extensions
This chapter describes how to configure Spanning Tree Protocol (STP) extensions on NX-OS devices.
For more information about the Data Center Network Manager features, see the Cisco DCNM Fundamentals Configuration Guide.
This chapter includes the following sections:
•
Information About STP Extensions
•
•
•
Note
Information About STP Extensions
Note
--logging-level spanning-tree 6
--logging logfile messages 6
--logging event link-status default
See the Cisco NX-OS System Management Configuration Guide for information on logging levels.
Note
Cisco has added extensions to STP that enhances loop prevention, protects against some possible user misconfigurations, and provides better control over the protocol parameters. Although, in some cases, similar functionality may be incorporated into the IEEE 802.1w Rapid Spanning Tree Protocol (RSTP) standard, we recommend using these extensions. All of these extensions, except PVST Simulation, can be used with both Rapid PVST+ and MST. You use PVST Simulation only with MST.
The available extensions are spanning tree edge ports (which supply the functionality previously known as PortFast), Bridge Assurance, BPDU Guard, BPDU Filtering, Loop Guard, Root Guard, and PVT Simulation. Many of these features can be applied either globally or on specified interfaces.
Note
This section discusses the following topics:
•
STP Port Types
You can configure a spanning tree port as an edge port, a network port, or a normal port. A port can be in only one of these states at a given time. The default spanning tree port type is normal.
Edge ports, which are connected to Layer 2 hosts, can be either an access port or a trunk port.
Note
Network ports are connected only to Layer 2 switches or bridges.
Note
STP Edge Ports
You connect STP edge ports only to Layer 2 hosts. The edge port interface immediately transitions to the forwarding state, without moving through the blocking or learning states. (This immediate transition was previously configured as the Cisco- proprietary feature PortFast.)
Interfaces that are connected to Layer 2 hosts should not receive STP Bridge Protocol Data Units (BPDUs).
Bridge Assurance
You can use Bridge Assurance to protect against certain problems that can cause bridging loops in the network. Specifically, you use Bridge Assurance to protect against a unidirectional link failure or other software failure and a device that continues to forward data traffic when it is no longer running the spanning tree algorithm.
Note
Bridge Assurance is enabled by default and can only be disabled globally. Also, Bridge Assurance can be enabled only on spanning tree network ports that are point-to-point links. Finally, both ends of the link must have Bridge Assurance enabled. If the device on one side of the link has Bridge Assurance enabled and the device on the other side either does not support Bridge Assurance or does not have this feature enabled, the connecting port is blocked.
With Bridge Assurance enabled, BPDUs are sent out on all operational network ports, including alternate and backup ports, for each hello time period. If the port does not receive a BPDU for a specified period, the port moves into the blocking state and is not used in the root port calculation. Once that port receives a BPDU, it resumes the normal spanning tree transitions.
Figure 6-1 shows a normal STP topology, and Figure 6-2 demonstrates a potential network problem when the device fails and you are not running Bridge Assurance.
Figure 6-1 Network with Normal STP Topology
Figure 6-2 Network Problem without Running Bridge Assurance
Figure 6-3 shows the network with Bridge Assurance enabled, and the STP topology progressing normally with bidirectional BPDUs issuing from every STP network port. Figure 6-4 shows how the potential network problem shown in Figure 6-2 does not happen when you have Bridge Assurance enabled on your network.
Figure 6-3 Network STP Topology Running Bridge Assurance
Figure 6-4 Network Problem Averted with Bridge Assurance Enabled
BPDU Guard
Enabling BPDU Guard shuts down that interface if a BPDU is received.
You can configure BPDU Guard at the interface level. When configured at the interface level, BPDU Guard shuts the port down as soon as the port receives a BPDU, regardless of the port type configuration.
When you configure BPDU Guard globally, it is effective only on operational spanning tree edge ports. In a valid configuration, Layer 2 LAN edge interfaces do not receive BPDUs. A BPDU that is received by an edge Layer 2 LAN interface signals an invalid configuration, such as the connection of an unauthorized device. BPDU Guard, when enabled globally, shuts down all spanning tree edge ports when they receive a BPDU.
BPDU Guard provides a secure response to invalid configurations, because you must manually put the Layer 2 LAN interface back in service after an invalid configuration.
Note
BPDU Filtering
You can use BPDU Filtering to prevent the device from sending or even receiving BPDUs on specified ports.
When configured globally, BPDU Filtering applies to all operational spanning tree edge ports. You should connect edge ports only to hosts, which typically drop BPDUs. If an operational spanning tree edge port receives a BPDU, it immediately returns to a normal spanning tree port type and moves through the regular transitions. In that case, BPDU Filtering is disabled on this port, and spanning tree resumes sending BPDUs on this port.
In addition, you can configure BPDU Filtering by the individual interface. When you explicitly configure BPDU Filtering on a port, that port does not send any BPDUs and drops all BPDUs that it receives. You can effectively override the global BPDU Filtering setting on individual ports by configuring the specific interface. This BPDU Filtering command on the interface applies to the entire interface, whether the interface is trunking or not.
Caution
Table 6-1 lists all the BPDU Filtering combinations.
Table 6-1 BPDU Filtering Configurations
Default1
Enable
Enable
Enable2
Default
Enable
Disable
Disable
Default
Disable
Not applicable
Disable
Disable
Not applicable
Not applicable
Disable
Enable
Not applicable
Not applicable
Enable
1 No explicit port configuration.
2 The port transmits at least 10 BPDUs. If this port receives any BPDUs, the port returns to the spanning tree normal port state and BPDU Filtering is disabled
Loop Guard
Loop Guard helps prevent bridging loops that could occur because of a unidirectional link failure on a point-to-point link.
An STP loop occurs when a blocking port in a redundant topology erroneously transitions to the forwarding state. This transition usually happens because one of the ports in a physically redundant topology (not necessarily the blocking port) stops receiving BPDUs.
Loop Guard enabled globally is useful only in switched networks where devices are connected by point-to-point links. On a point-to-point link, a designated bridge cannot disappear unless it sends an inferior BPDU or brings the link down. However, you can enable Loop Guard on shared links per interface,
You can use Loop Guard to determine if a root port or an alternate/backup root port receives BPDUs. If the port that was previously receiving BPDUs is no receiving longer BPDUs, Loop Guard puts the port into an inconsistent state (blocking) until the port starts to receive BPDUs again. If such a port receives BPDUs again, the port—and link—is deemed viable again. The protocol removes the loop-inconsistent condition from the port, and the STP determines the port state because such recovery is automatic.
Loop Guard isolates the failure and allows STP to converge to a stable topology without the failed link or bridge. Disabling Loop Guard moves all loop-inconsistent ports to the listening state. (See Chapter 5, "Configuring Rapid PVST+" for information on STP port states.)
You can enable Loop Guard on a per-port basis. When you enable Loop Guard on a port, it is automatically applied to all of the active instances or VLANs to which that port belongs. When you disable Loop Guard, it is disabled for the specified ports.
Root Guard
When you enable Root Guard on a port, Root Guard does not allow that port to become a root port. If a received BPDU triggers an STP convergence that makes that designated port become a root port, that port is put into a root-inconsistent (blocked) state. After the port stops send superior BPDUs, the port is unblocked again. Through STP, the port moves to the forwarding state. Recovery is automatic.
If Root Guard is enabled on an interface, this functionality applies to all VLANs to which that interface belongs.
You can use Root Guard to enforce the root bridge placement in the network. Root Guard ensures that the port on which Root Guard is enabled is the designated port. Normally, root bridge ports are all designated ports, unless two or more of the ports of the root bridge are connected. If the bridge receives superior BPDUs on a Root Guard-enabled port, the bridge moves this port to a root-inconsistent STP state. In this way, Root Guard enforces the position of the root bridge.
You cannot configure Root Guard globally.
Applying STP Extension Features
We recommend that you configure the various STP extension features through your network as shown in Figure 6-5. Bridge Assurance is enabled on the entire network. You should enable either BPDU Guard or BPDU Filtering on the host interface.
Figure 6-5 Network with STP Extensions Correctly Deployed
PVST Simulation
MST interoperates with Rapid PVST+ with no need for user configuration. The PVST simulation feature enables this interoperability.
Note
However, you may want to control the connection between MST and Rapid PVST+ to protect against accidentally connecting an MST-enabled port to a port enabled to run Rapid PVST+. Because Rapid PVST+ is the default STP mode, you may encounter many Rapid PVST+ connections.
Disabling Rapid PVST+ simulation, which can be done globally for the entire device, moves the MST-enabled port to the blocking state once it detects it is connected to a Rapid PVST+-enabled port. This port remains in the inconsistent state until the port stops receiving Rapid PVST+/SSTP BPDUs, and then the port resumes the normal STP transition process.
The root bridge for all STP instances must all be in either the MST region or the Rapid PVST+ side. If the root bridge for all STP instances are not on one side or the other, the software moves the port into a PVST simulation-inconsistent state.
Note
High Availability
The software supports high availability for STP. However, the statistics and timers are not restored when STP restarts. The timers start again and the statistics begin from 0.
Note
Virtualization Support
The system provides support for virtual device contexts (VDCs). and each VDC runs a separate STP. You can run Rapid PVST+ in one VDC and MST in another VDC.
Note
Licensing Requirements for STP Extensions
The following table shows the licensing requirements for this feature:
However, using VDCs requires an Advanced Services license.
Prerequisites for STP Extensions
STP has the following prerequisites:
•
•
Guidelines and Limitations
Follow these guidelines and limitations when configuring STP extensions:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Note
•
•
Configuring STP Extensions
This section includes the following topics:
•
•
•
•
You can enable Loop Guard per interface on either shared or point-to-point links.
Setting Default Values for STP Extensions
You use the Spanning Tree pane to return to the default settings for these features (see Figure 6-6).
Figure 6-6 Configuring STP Extensions
DETAILED STEPS
To set the STP extensions to the default settings either globally or per port, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
The Port Setting section expands and displays the ports.
Step 6
Step 7
Step 8
Setting STP Extensions Globally
You use the Spanning Tree pane to configure STP extensions globally (see Figure 6-6).
DETAILED STEPS
To set the STP extensions globally, follow these steps:
Step 1
Step 2
Step 3
Step 4
The Global Setting section expands.
Step 5
The default port type is Normal STP.
Step 6
Bridge Assurance is enabled by default.
Step 7
BPDU Guard is disabled by default.
Step 8
BPDU Filter is disabled by default.
Step 9
Loop Guard is disabled by default.
Step 10
Configuring PVST Simulation Globally
Note
You configure PVST simulation only when you are running MST on the device (Rapid PVST+ is the default STP mode). MST interoperates with Rapid PVST+. However, to prevent an accidental connection to a device that does not run MST as the default STP mode, you may want to disable this automatic feature. If you disable PVST simulation, the MST-enabled port moves to the blocking state once it detects it is connected to a Rapid PVST+-enabled port. This port remains in the inconsistent state until the port stops receiving BPDUs, and then the port resumes the normal STP transition process.
You use the Spanning Tree pane to configure PVST simulation (see Figure 6-6).
DETAILED STEPS
To configure PVST simulation globally, follow these steps:
Step 1
Step 2
The system highlights the device in the Summary pane, and tabs appear in the Details pane
Step 3
Step 4
Step 5
The default is Enabled.
Step 6
Setting STP Extensions Per Interface
You use the Spanning Tree pane to configure the STP extensions per interface (see Figure 6-6).
DETAILED STEPS
To set the STP extensions per interface, follow these steps:
Step 1
Step 2
Step 3
Step 4
The Port Setting section expands.
Step 5
Step 6
By default, the port type for each interface is set to Default, which returns the port type to the globally set port type.
Step 7
By default, the BPDU Guard setting for each interface is set to Default, which returns the interface to the globally set BPDU Guard value.
Step 8
By default, the BPDU Filter setting for each interface is set to Default, which returns the interface to the globally set BPDU Filter value.
Step 9
By default, the Guard setting for each interface is set to Default, which returns the interface to the globally set Loop Guard value.
Step 10
Field Descriptions for Configuring STP Extensions
The following topics describe the fields for setting the type of STP that you want to run, configuring many MST settings, and configuring the STP extension features:
•
•
Device: Configuration: Global Setting Section
Device: Configuration: Port Setting Section
Additional References
For additional information related to implementing these STP extensions, see the following sections:
•
Related Documents
Standards
IEEE 802.1Q-2006 (formerly known as IEEE 802.1s), IEEE 802.1D-2004 (formerly known as IEEE 802.1w), IEEE 802.1D, IEEE 802.1t
—
MIBs
•
•
To locate and download MIBs, go to the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
