Switching · Spanning Tree

Loop guard and UDLD

Prevent loss of control reception from activating an unsafe redundant path.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

Classic PVST+ is used to expose original STP behavior; rapid-PVST+ and MST are separate lessons.

Use three fresh isolated switches with Gigabit trunks: SW1 Gi1/0/23 ↔ SW2 Gi1/0/23; SW1 Gi1/0/24 ↔ SW3 Gi1/0/24; SW2 Gi1/0/24 ↔ SW3 Gi1/0/23. Both VLANs10/20 exist on every switch. Baseline SW1/SW2/SW3 priorities are4096/8192/12288, with short costs and no extra links. Start independently from the included baseline for each lesson; subsequent repair snippets apply to the named device.

Physical links are solid; device roles and relevant links are labeled.

How it works

A unidirectional fault can leave the physical link up while a non-designated port stops receiving expected BPDUs. Without protection, aging the stored information might let it become designated/forwarding and create a loop. Loop guard keeps an affected instance loop-inconsistent instead.

UDLD separately checks bidirectional neighbor communication on supported links. Aggressive mode can disable a link that fails its neighbor checks. It is not an STP instance-role calculation. Loop guard, root guard and BPDU guard have different placement rules; do not combine contradictory root and loop guard intent on one port.

Configure or inspect

SW1

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 4096
spanning-tree vlan 20 priority 4096
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit

SW2

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 8192
spanning-tree vlan 20 priority 8192
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit

SW3

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 12288
spanning-tree vlan 20 priority 12288
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit
interface GigabitEthernet1/0/23
 spanning-tree guard loop
 udld port aggressive

Verify the result

Illustrative output · selected lines

SW3#show spanning-tree inconsistentports
Name        Interface            Inconsistency
VLAN0010    GigabitEthernet1/0/23 Loop Inconsistent
SW3#show udld interface GigabitEthernet1/0/23
Port enable administrative configuration setting: Enabled / aggressive
Current bidirectional state: Bidirectional

These are selected independent observations: loop-inconsistent illustrates missing STP control information; a bidirectional UDLD result can coexist with a BPDU-specific filter. Do not claim every missing BPDU is a broken fiber.

Failure and recovery

Investigate media, optics, remote state and protocol filtering. Restore bidirectional/control reception; if UDLD disabled the interface, recover only after the physical cause is corrected.

Repair the failed receive path or unintended BPDU filter, then verify UDLD neighbors and spanning-tree consistency before returning the redundant link to service.

Key Takeaways

Loop guard protects expected BPDU reception.
It can hold individual instances loop-inconsistent.
UDLD tests bidirectional neighbor communication.
Missing BPDUs can be a filter, not just broken fiber.
Placement must match each guard’s purpose.