spanning-tree guard loop
Configures loop guard on a spanning-tree port to prevent alternate or root ports from becoming designated in the absence of BPDUs, protecting against unidirectional link failures.
Definition: spanning-tree guard loop is a Cisco IOS interface config command. Configures loop guard on a spanning-tree port to prevent alternate or root ports from becoming designated in the absence of BPDUs, protecting against unidirectional link failures.
Overview
The `spanning-tree guard loop` command is a critical tool for enhancing the resilience of Spanning Tree Protocol (STP) in switched networks. It configures loop guard on a specific interface to prevent a port from transitioning into the designated state if it stops receiving Bridge Protocol Data Units (BPDUs). This protects against unidirectional link failures, where a link remains physically up but data can only travel in one direction, causing a silent bridging loop.
Loop guard is particularly important in redundant topologies where a failure could lead to a loss of connectivity or broadcast storms. Unlike root guard, which prevents a port from becoming a root port, loop guard focuses on preventing alternate or root ports from becoming designated when BPDUs are absent. It is typically used on ports that should be blocking or alternate, but could become designated due to a failure.
The command is applied in interface configuration mode and takes effect immediately, adding the configuration to the running config. It requires privileged EXEC access (enable mode) and is available in IOS versions 12.2 and later. Loop guard works by placing the port into a loop-inconsistent state if BPDUs are not received, effectively blocking traffic until BPDUs resume.
This is distinct from UDLD (Unidirectional Link Detection), which actively sends probes to detect failures; loop guard relies on the absence of BPDUs. In a typical workflow, loop guard is configured on all ports that are not designated, especially on distribution switches where redundant links exist. It complements other STP enhancements like PortFast, BPDU guard, and root guard.
Understanding loop guard is essential for CCNA and CCNP candidates as it is a common topic in exams and real-world network design.
spanning-tree guard loopWhen to Use This Command
- On a switch port connected to a critical server where a unidirectional link failure could cause a bridging loop.
- On access ports in a redundant topology where BPDU guard is not enough and you need additional protection against loops.
- On ports connecting to other switches in a spanning-tree network to ensure loops are not created if BPDUs stop arriving.
- On ports where you suspect faulty fiber or media converters that might cause one-way traffic.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| loop | loop | Enables loop guard on the interface. This is the only keyword for this command. It instructs the switch to monitor the interface for BPDU reception and place the port into a loop-inconsistent state if BPDUs are not received. Common mistake: forgetting that loop guard is incompatible with PortFast; if PortFast is enabled, loop guard is ignored. |
Command Examples
Enable loop guard on an interface
spanning-tree guard loopNo output is generated when this command is entered. The command simply enables loop guard on the interface. Use 'show spanning-tree interface gigabitethernet0/1 detail' to verify.
Verify loop guard configuration
show spanning-tree interface gigabitethernet0/1 detailGigabitEthernet0/1 is up, line protocol is up Port id: 128.1 Port role: Designated Port state: forwarding Loop guard: enabled Root guard: disabled BPDU guard: disabled BPDU filter: disabled ...
The output shows the interface status, port role, port state, and the status of various STP protections. 'Loop guard: enabled' confirms that loop guard is active on this port.
Understanding the Output
The 'show spanning-tree interface <interface> detail' command displays the STP configuration for a specific interface. Key fields include: 'Port role' (Designated, Root, Alternate, Backup), 'Port state' (forwarding, blocking, listening, learning), and protection settings like 'Loop guard', 'Root guard', 'BPDU guard', and 'BPDU filter'. Loop guard being 'enabled' means the port will be put into loop-inconsistent state if BPDUs are not received, preventing a loop.
If loop guard is 'disabled', the port may become designated and cause a loop. In a real network, you should see loop guard enabled on ports where unidirectional link failure is a concern. A good value is 'enabled' on such ports; a bad value is 'disabled' when you intended to enable it.
Watch for 'Loop guard: enabled' to confirm configuration.
Configuration Scenarios
Configure loop guard on a distribution switch uplink to prevent loops from unidirectional link failure
A distribution switch (SW1) has two redundant uplinks to a core switch (SW2). One uplink is the root port, the other is an alternate port. If a unidirectional failure occurs on the root port, the alternate port might become designated and cause a loop. Loop guard prevents this.
Topology
SW1(Gi0/1)---10.0.12.0/30---(Gi0/1)SW2
SW1(Gi0/2)---10.0.13.0/30---(Gi0/2)SW2Steps
- 1.Step 1: Enter privileged EXEC mode: enable
- 2.Step 2: Enter global configuration mode: configure terminal
- 3.Step 3: Enter interface configuration mode for the alternate port: interface gigabitethernet0/2
- 4.Step 4: Enable loop guard: spanning-tree guard loop
- 5.Step 5: Exit and verify: end, show spanning-tree interface gigabitethernet0/2 detail
! interface GigabitEthernet0/2 spanning-tree guard loop !
Verify: Use 'show spanning-tree interface gigabitethernet0/2 detail' and look for 'Guard: Loop' in the output. Also check 'show spanning-tree' to see the port state; if BPDUs are missing, the port will show 'loop-inconsistent'.
Watch out: Loop guard is incompatible with PortFast. If PortFast is configured on the same interface, loop guard is disabled. Ensure PortFast is not enabled on ports where loop guard is needed.
Configure loop guard on all non-designated ports on an access switch to protect against misconfigurations
An access switch (SW3) connects to two distribution switches (SW4 and SW5) for redundancy. To ensure that any unidirectional link failure does not cause a loop, loop guard is applied on all ports that are not designated (root and alternate ports).
Topology
SW3(Gi0/1)---10.0.14.0/30---(Gi0/1)SW4
SW3(Gi0/2)---10.0.15.0/30---(Gi0/2)SW5Steps
- 1.Step 1: Enter privileged EXEC mode: enable
- 2.Step 2: Enter global configuration mode: configure terminal
- 3.Step 3: Enter interface range configuration: interface range gigabitethernet0/1-2
- 4.Step 4: Enable loop guard: spanning-tree guard loop
- 5.Step 5: Exit and verify: end, show spanning-tree interface gigabitethernet0/1 detail | include Guard
! interface range GigabitEthernet0/1-2 spanning-tree guard loop !
Verify: Use 'show spanning-tree' to see the port roles and states. For each interface, the output should show 'Guard: Loop' in the detail. If a failure occurs, the port will enter 'loop-inconsistent' state.
Watch out: Loop guard should not be used on ports connected to devices that do not run STP (e.g., some servers or routers) because they will never send BPDUs, causing the port to be permanently blocked. Only use on ports where BPDUs are expected.
Troubleshooting with This Command
When troubleshooting loop guard issues, the primary command is 'show spanning-tree interface <interface> detail'. Healthy output shows 'Guard: Loop' and the port state as 'blocking' or 'alternate' (if not root). Problem indicators include the port state showing 'loop-inconsistent', which means BPDUs have stopped being received.
This could indicate a unidirectional link failure, a misconfiguration (e.g., PortFast enabled), or a faulty cable. Focus on the 'Guard' field and the 'Port State' field. Common symptoms: intermittent connectivity, broadcast storms, or high CPU usage due to STP reconvergence.
A step-by-step diagnostic flow: 1) Identify the port in loop-inconsistent state using 'show spanning-tree'. 2) Check the interface status with 'show interfaces <interface>' to ensure it is up/up. 3) Verify that BPDUs are expected on that port (e.g., it connects to another switch). 4) Check for PortFast configuration with 'show running-config interface <interface>'. 5) Use 'debug spanning-tree events' to see if BPDUs are being received. Correlate with 'show logging' to see if the port has flapped. If the port is loop-inconsistent, it will automatically recover when BPDUs resume, but manual intervention may be needed if the failure is permanent.
Loop guard can also be disabled globally with 'no spanning-tree loopguard default' if needed. Remember that loop guard works per-VLAN; if the port is in loop-inconsistent for one VLAN, it is blocked for all VLANs on that port.
CCNA Exam Tips
CCNA exam tip: Loop guard is configured per interface, not globally. Know the difference between loop guard and BPDU guard.
CCNA exam tip: Loop guard prevents alternate/root ports from becoming designated if BPDUs stop; it does not affect designated ports.
CCNA exam tip: Loop guard and root guard cannot be enabled simultaneously on the same port; they are mutually exclusive.
CCNA exam tip: In the exam, you may be asked to identify which STP protection to use in a scenario with unidirectional link failure.
Common Mistakes
Mistake: Enabling loop guard on a port that is already a designated port; loop guard has no effect on designated ports.
Mistake: Confusing loop guard with BPDU guard; BPDU guard err-disables a port if a BPDU is received, while loop guard puts the port into loop-inconsistent state if BPDUs are not received.
Mistake: Forgetting to verify loop guard with 'show spanning-tree interface' after configuration.
spanning-tree guard loop vs spanning-tree guard root
Both commands enhance STP stability by placing a port in a blocked state under specific conditions, but they protect against different threats: loop guard detects unidirectional link failures, while root guard prevents unauthorized root bridges. They are mutually exclusive on a port.
| Aspect | spanning-tree guard loop | spanning-tree guard root |
|---|---|---|
| Protection target | Unidirectional link failures | Rogue root bridge |
| Behavior on violation | Port becomes loop-inconsistent (blocked) | Port becomes root-inconsistent (blocked) |
| Mutual exclusivity | Cannot be used with root guard on same port | Cannot be used with loop guard on same port |
| Typical placement | On ports that are alternate or root ports in stable topology | On ports expected to be non-root, e.g., edge ports |
| Configuration mode | Interface configuration | Interface configuration |
Use spanning-tree guard loop when you suspect potential unidirectional link failures that could cause forwarding loops.
Use spanning-tree guard root on ports that should never become root ports, such as those connecting to untrusted switches or end-user devices.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850), the syntax is identical: 'spanning-tree guard loop' under interface configuration. The output of 'show spanning-tree' is similar but may include additional fields like 'OperEdge' for PortFast. In NX-OS (e.g., Nexus 9000), the equivalent command is 'spanning-tree guard loop' under interface configuration as well, but NX-OS also supports 'spanning-tree loopguard default' globally.
Note that NX-OS uses 'show spanning-tree interface <interface> detail' for verification. On ASA firewalls, STP is not typically used, so this command does not apply. In IOS-XR (e.g., ASR 9000), STP is not supported; instead, use Ethernet OAM or other mechanisms.
For IOS versions prior to 12.2, loop guard may not be available; it was introduced in 12.2(25)SEC. In later versions (15.x, 16.x), the command remains unchanged. Always check the specific platform documentation, as some older switches may require 'spanning-tree guard loop' to be enabled globally first with 'spanning-tree loopguard default'.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions