Hands-On Lab: Configuring Loop Guard

Lab Objective

Configure Loop Guard on a switch's alternate (blocking) port in a redundant topology, simulate the loss of incoming BPDUs on that port without the link itself failing, and verify Loop Guard prevents the port from incorrectly transitioning to forwarding.

Lab Purpose

Root Guard, discussed in an earlier lab, protects against a port receiving a superior BPDU it should not. Loop Guard protects against the opposite problem: a port that stops receiving BPDUs entirely due to a unidirectional link failure, which would otherwise cause STP to incorrectly assume the alternate path is safe to activate, creating an actual Layer 2 loop.

Lab Topology

Switch1 ---- Gi1/0/1 ---- Switch2 (designated/forwarding)
Switch1 ---- Gi1/0/2 ---- Switch2 (alternate/blocking,
                          redundant link)

Task 1: Verify Current Port Roles

Confirm Gi1/0/1 is forwarding and Gi1/0/2 is in the alternate/blocking role.

Task 2: Configure Loop Guard on the Blocking Port

Enable Loop Guard on Gi1/0/2.

Task 3: Simulate a Unidirectional BPDU Loss

Simulate the scenario where Gi1/0/2 stops receiving BPDUs (representing a unidirectional fiber failure or similar) without the interface itself going administratively or physically down.

Task 4: Verify Loop Guard Prevents Incorrect Forwarding

Confirm the port enters a loop-inconsistent state rather than transitioning to forwarding as it normally would once BPDUs stop arriving.

Task 5: Restore BPDU Reception and Verify Recovery

Restore normal BPDU reception and confirm the port automatically returns to its correct blocking role.

Solution and Verification

Switch1# show spanning-tree vlan 1

Interface     Role  Sts  Cost   Prio.Nbr
Gi1/0/1       Root  FWD  4      128.1
Gi1/0/2       Altn  BLK  4      128.2

Switch1(config)# interface gigabitethernet1/0/2
Switch1(config-if)# spanning-tree guard loop

-- Simulated: Gi1/0/2 stops receiving BPDUs
-- (unidirectional failure) while remaining
-- physically/administratively up

-- Without Loop Guard, STP would normally
-- interpret the absence of BPDUs as "the
-- upstream device is gone" and transition
-- this port to forwarding after the max
-- age timer expires -- creating an actual
-- loop, since Gi1/0/1 is still forwarding too

Switch1# show spanning-tree vlan 1

Interface     Role  Sts        Cost   Prio.Nbr
Gi1/0/1       Root  FWD         4      128.1
Gi1/0/2       Altn  BKN*        4      128.2
*LOOP_Inc

Switch1# show spanning-tree inconsistentports

Name                 Interface        Inconsistency
VLAN0001             Gi1/0/2          Loop Inconsistent
-- The port is held in blocking rather than
-- being allowed to transition to forwarding,
-- exactly preventing the loop that would
-- otherwise form

-- BPDU reception restored on Gi1/0/2

Switch1# show spanning-tree vlan 1

Interface     Role  Sts  Cost   Prio.Nbr
Gi1/0/1       Root  FWD  4      128.1
Gi1/0/2       Altn  BLK  4      128.2
-- Automatically recovered to its correct
-- alternate/blocking role once BPDUs
-- resumed, no manual intervention required

Key Takeaway

Loop Guard and Root Guard, covered in an earlier lab, protect against opposite failure directions on opposite port roles: Root Guard is applied to designated ports to reject unexpected superior BPDUs, while Loop Guard is applied to non-designated (alternate/backup) ports to prevent them from incorrectly transitioning to forwarding when BPDUs simply stop arriving — Cisco recommends applying Loop Guard specifically on all non-designated ports of switches with redundant links, a broader scope than the single-port examples shown in these labs.