STP guard?

Options
Alex_91
Alex_91 Posts: 56 image  Ally Member
First Comment Friend Collector Seventh Anniversary
in Switch

I noticed activating RSTP on the switch ports activates the "STP guard" option but I don't understand well what the difference is between keeping the option disabled, or activating the two "root guard" or "BPDU", with only RSTP and none what happens?

Accepted Solution

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,992 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    Answer ✓
    Options

    Hi @Alex_91

    Yes, loop guard is for the ports that you design where end devices will connect with. Nebula default set all ports enable RSTP is because we want to prevent the customer connect a ring topology without configure it and cause loop.

    Below is the possible result or issue/behavior for each scenario for you to reference:

    Scenario

    Possible result or issue / behavior

    RSTP enable only (STP guard disable)

    Spanning tree topology changes when receiving untrusted BPDU packet and causes network issue.

    RSTP enable + Root guard

    Prevent root bridge changes when receiving higher priority BPDU packet. The port will change to err-disable status.

    RSTP enable + BPDU guard

    Prevent receiving any BPDU packets. The port will change to err-disable status.

    Zyxel Melen


All Replies

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,992 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    edited July 23
    Options

    Hi @Alex_91

    The STP guard option only displays when the port enables RSTP. Below is the explanation/behavior of each STP guard option:

    • Root guard is to prevent any switch in your ring topology do spanning tree topology change when receive BPDU that has higher priority than root bridge.
    • BPDU guard is to prevent any switch in your ring topology receive any BPDU packets.

    Both of them will block the port when receiving related packets.

    With none of these protections, your ring topology might have topology change when receive any BPDU and cause temporary network down.

    Zyxel Melen


  • Alex_91
    Alex_91 Posts: 56 image  Ally Member
    First Comment Friend Collector Seventh Anniversary
    Options

    and what happens if you keep the option disabled?

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,992 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    Options

    Hi @Alex_91

    Which option? STP guard? If STP guard is disabled, the switch won't disable switch port to protect your ring topology when receiving any BPDU packets.

    Zyxel Melen


  • Alex_91
    Alex_91 Posts: 56 image  Ally Member
    First Comment Friend Collector Seventh Anniversary
    edited July 23
    Options
  • Alex_91
    Alex_91 Posts: 56 image  Ally Member
    First Comment Friend Collector Seventh Anniversary
    Options

    No, to summarize:

    Loop Guard is recommended on ports where end devices (PCs, hubs, etc.) are connected.

    RSTP is recommended on ports used to connect other switches (only?). But what difference does enabling or disabling the various options make? What if I enable RSTP but leave none on STP guard?

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,992 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    Answer ✓
    Options

    Hi @Alex_91

    Yes, loop guard is for the ports that you design where end devices will connect with. Nebula default set all ports enable RSTP is because we want to prevent the customer connect a ring topology without configure it and cause loop.

    Below is the possible result or issue/behavior for each scenario for you to reference:

    Scenario

    Possible result or issue / behavior

    RSTP enable only (STP guard disable)

    Spanning tree topology changes when receiving untrusted BPDU packet and causes network issue.

    RSTP enable + Root guard

    Prevent root bridge changes when receiving higher priority BPDU packet. The port will change to err-disable status.

    RSTP enable + BPDU guard

    Prevent receiving any BPDU packets. The port will change to err-disable status.

    Zyxel Melen


Categories

Switch Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）