Using Spanning-Tree BPDU-Filter to Fix Switch Loops

I would like to go over a spanning-tree option that I use many times to “fix” some switch networks, BPDU-Filter. To start talking about BPDU-Filter, we will need to first talk about what is and why have spanning-tree.

Spanning-Tree Protocol

Spanning-tree protocol (STP) is a network protection protocol that allows for setting up loop-free topology for Ethernet networks. The purpose of spanning-tree protocol is to prevent layer-2 or switch loops. Switches forward Ethernet frames based on the destination MAC address. Broadcast frames are sent to all switch ports in the network. A switch loop is where an Ethernet frame is forwarded around in a loop. The issue here is Ethernet frames do not have a time to live (TTL) like IP packets, so there is no way to tell if that information is a duplicate. When a layer-2 or switch loop happens, it starts off slowly, but eventually takes up all free resources on the switches. This happens because every new broadcast adds to the overall flow, but none of the older broadcasts ever leave the loop.

So how does the Spanning-Tree Protocol (STP) fight against the switch loop problem. The answer is Bridge Protocol Data Units (BPDU). Switches send special Ethernet broadcast frames with information about spanning-tree protocol. If a switch sees its own BPDU come back on an interface, it knows that there is a loop in path and shuts down the interface (error disables the interface). By default, BPDU are sent across all interfaces every 2 seconds.

Some switches will not allow other switches to connect to them. This is typically done for a licensing or money grab issue–i.e., purchase a more expensive switch to allow a switch-to-switch connection. (I am looking at you Cisco, on the Nexus FEX switches.)

So if you have a Nexus FEX switch, how does it know a switch is connected? It watches for BPDU coming into that interface. If it sees one, it will shut down the interface. If you need to force a switch connection, what you need to do is turn on spanning-tree bpdufilter.

This can be done with the command “spanning-tree bpdufilter enable” on the interface.

This will remove all BPDU going through the interface (both directions). This will allow the switch connection to come up. It should be noted that you are breaking spanning-tree at this one interface and if you have a loop, it could take down your network. But bpdu-filter is a great tool to use, if you know your topology.

Jason Howe, Senior Network Architect