Understanding Root Guard; Configuring Stp Extensions; Stp Extensions Configuration Guidelines - Cisco N5010P-N2K-BE Software Configuration Manual

Chapter 10

Configuring STP Extensions

S e n d f e e d b a c k t o n x 5 0 0 0 - d o c f e e d b a c k @ c i s c o . c o m

Understanding Root Guard

When you enable Root Guard on a port, Root Guard does not allow that port to become a root port. If a
received BPDU triggers an STP convergence that makes that designated port become a root port, that
port is put into a root-inconsistent (blocked) state. After the port stops send superior BPDUs, the port is
unblocked again. Through STP, the port moves to the forwarding state. Recovery is automatic.
Root Guard enabled on an interface applies this functionality to all VLANs to which that interface
belongs.
You can use Root Guard to enforce the root bridge placement in the network. Root Guard ensures that
the port on which Root Guard is enabled is the designated port. Normally, root bridge ports are all
designated ports, unless two or more of the ports of the root bridge are connected. If the bridge receives
superior BPDUs on a Root Guard-enabled port, the bridge moves this port to a root-inconsistent STP
state. In this way, Root Guard enforces the position of the root bridge.
You cannot configure Root Guard globally.
Note You can enable Root Guard on all spanning tree port types: normal, edge, and network ports.
Configuring STP Extensions
This section includes the following topics:
•
•
•
•
•
•
•
•
•
•

STP Extensions Configuration Guidelines

When configuring STP extensions, follow these guidelines:
•
•
•
•
•
OL-16597-01
STP Extensions Configuration Guidelines, page 10-5
Configuring Spanning Tree Port Types Globally, page 10-6
Configuring Spanning Tree Edge Ports on Specified Interfaces, page 10-7
Configuring Spanning Tree Network Ports on Specified Interfaces, page 10-7
Enabling BPDU Guard Globally, page 10-8
Enabling BPDU Guard on Specified Interfaces, page 10-9
Enabling BPDU Filtering Globally, page 10-10
Enabling BPDU Filtering on Specified Interfaces, page 10-10
Enabling Loop Guard Globally, page 10-12
Enabling Loop Guard or Root Guard on Specified Interfaces, page 10-12
Configure all access and trunk ports connected to hosts as edge ports.
Bridge Assurance runs only on point-to-point spanning tree network ports. You must configure each
side of the link for this feature.
Loop Guard does not run on spanning tree edge ports.
Enabling Loop Guard on ports that are not connected to a point-to-point link will not work.
You cannot enable Loop Guard if Root Guard is enabled.
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
Configuring STP Extensions
10-5