Loop Guard is an STP security mechanism that protects against Layer 2 loops that can occur even with STP enabled. It is applied on non-designated / blocked ports in redundant topologies.
Which problem does it solve?
🔴 A port should stay blocked, but stops receiving BPDUs.
If a switch stops receiving BPDUs on a port, it can falsely believe the loop is gone and open the port → loop 💥. Causes: software failure on the upstream switch, hung STP process, CPU overload, misconfigured BPDU filter. Loop Guard prevents the port from entering forwarding in this case.
What Loop Guard concretely does
- The port is blocked (Alternate / Non-designated)
- The switch stops receiving BPDUs
- Instead of going to forwarding, the port is put into the loop-inconsistent state
- The port forwards no traffic and stays locked until BPDUs return
- When BPDUs return → normal STP process resumes
➡️ Fail-safe behaviour 👍
| State | Meaning |
|---|---|
| Blocking / Alternate | Normal STP blocking |
| Loop-inconsistent | Loop Guard has intervened |
| Forwarding | Only when BPDUs are received correctly |
Classic exam scenario
S1 (Root)
| \
| \
S2---S3The S2–S3 link is blocked. S3 stops receiving BPDUs on that link.
- Without Loop Guard: the port goes to forwarding → loop 😬
- With Loop Guard: the port goes loop-inconsistent → no loop 💚
Loop Guard vs UDLD (important!)
| Feature | Loop Guard | UDLD |
|---|---|---|
| Protects against missing BPDUs | ✅ | ❌ |
| Protects against unidirectional links | ⚠️ indirect | ✅ |
| Reaction | loop-inconsistent | err-disabled |
| Granularity | Per-VLAN | Per-port |
| Depends on STP | Yes | No |
Loop Guard = STP logic · UDLD = physical link verification
When to use Loop Guard
- Redundant uplinks between switches
- Distribution ↔ access
- Where you expect BPDUs constantly
- Together with Root Guard (but not on access ports)