Routelearn.net
Course menu

Course 6: Spanning Tree ProtocolLesson 4.6 (21 of 24 in this course)42 of 91 in the CCNA series

Loop Guard

Keeping a blocked port blocked when its BPDUs stop arriving.

Advanced · 5 min read

Loop Guard is a Cisco Spanning Tree protection feature that stops a root or alternate port from moving to forwarding when it stops receiving BPDUs. The port is put into the loop-inconsistent (blocked) state instead, guarding against loops caused by unidirectional link failures.

In simple terms: If a blocked port suddenly stops hearing from the switch next to it, that could be a faulty link rather than a real change. Loop Guard keeps the port blocked instead of risking a loop.

The dangerous assumption

STP thinks that if a port stops receiving BPDUs, the switch at the other end has gone. Usually that's true. But some links only work in one direction. This is called a unidirectional link. For example, one fibre strand is broken, or a transceiver (the plug-in optic module) is faulty. Traffic still goes one way, but BPDUs stop arriving from the other way. Then STP makes the wrong decision.

Without Loop Guard

Situation: on the SW2–SW3 link, the direction from SW2 to SW3 fails. So SW3's alternate port stops receiving BPDUs. The direction from SW3 to SW2 still works.

DPRPDPRPDPALTSW1priority 24576SW2priority 32768SW3priority 32768PC APC B
  1. 1. BPDUs stop arriving. The SW2 → SW3 direction fails. SW3's alternate port hears nothing.
  2. 2. STP thinks SW2 is gone. When the stored information runs out, SW3 decides its port should be designated on this link, and starts forwarding.
  3. 3. Loop. SW3 → SW2 still works, and SW2's end was already forwarding. Frames now go round and round the triangle.

With Loop Guard

Loop Guard has a simple rule: if a root or alternate port stops receiving BPDUs, don't let it start forwarding. Put it in the loop-inconsistent state (blocked) instead.

DPRPDPRPDPALTSW1priority 24576SW2priority 32768SW3priority 32768PC APC B
  1. 1. Same failure. SW3's alternate port stops hearing BPDUs.
  2. 2. Loop-inconsistent: stays blocked. Loop Guard doesn't let it start forwarding. There is no loop.
  3. 3. Recovers by itself. When BPDUs arrive again (the link is fixed), the port goes back to its normal role by itself.

Why the receiver can't tell

From SW3's side, "SW2 has nothing to send" and "the light from SW2 never arrives" look the same: silence. Both ends still show the link as up. The only clue is that the expected BPDUs are missing. How long STP waits before acting depends on the version:

VersionA silent port's information runs out after
802.1D / PVST+Max age: 20 s
RSTP / Rapid PVST+3 missed hellos: 6 s

That is exactly when Loop Guard acts. Remember who sends what. Designated ports face away from the root and send BPDUs. Root and alternate ports face toward the root and receive them. So if a root or alternate port goes silent, something is wrong. Those are the ports Loop Guard watches.

Loop Guard doesn't forbid the designated role

Many people get this wrong. Loop Guard only blocks a port that would become designated because its BPDUs stopped arriving. If the network really changes, and BPDUs from the other switch show that the port should now be designated, it becomes designated as normal.

What happens to SW3's alternate portLoop Guard's reaction
BPDUs from SW2 stop arriving, and the timer runs outLoop-inconsistent (blocked)
SW2 loses its own path to the root and sends worse BPDUs. SW3's port wins.Allowed: the port becomes designated and forwards
SW3's root port fails, and the alternate port becomes the new root portAllowed: it still receives BPDUs

Where to put it

  • On root and alternate ports, on links between switches.
  • Not on edge (PortFast) ports. Not on the same port as Root Guard, because they work against each other.
  • The global command is the simplest. It applies to point-to-point links.

Configure and verify

spanning-tree loopguard default

For the whole switch.

interface GigabitEthernet1/0/2 spanning-tree guard loop

Or on one interface.

Example output · based on Cisco documentation; exact format varies by platform and software version
%SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet1/0/2 on VLAN0010.
Example output · based on Cisco documentation; exact format varies by platform and software version
SW3#show spanning-tree inconsistentports
Name                 Interface                Inconsistency
-------------------- ------------------------ ------------------
VLAN0010             GigabitEthernet1/0/2     Loop Inconsistent

Number of inconsistent ports (segments) in the system : 1
A port that is Loop Inconsistent means the link may only be working in one direction. Check the cables and optics, and think about using UDLD (next lesson). In show spanning-tree the port shows BKN* with *LOOP_Inc. Cisco runs a tree for each VLAN, so this is decided for each VLAN. The port may be blocked in one VLAN and normal in others.
Example output · based on Cisco documentation; exact format varies by platform and software version
%SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet1/0/2 on VLAN0010.
RSTP(10): updt roles, received superior bpdu on Gi1/0/2
RSTP(10): Gi1/0/2 is now alternate
After the repair, BPDUs arrive again, and the port goes back to alternate by itself. There is nothing to reset.

💡 Lab tip: it is hard to break a real cable in just one direction. In a simulator such as Cisco Modeling Labs, you can stop traffic on a link while both ports stay up. This copies the silent-port problem.

Check yourself

Predict · scenario 1

Which ports does Loop Guard protect?

Predict · scenario 2

What usually causes a port to become loop-inconsistent?