Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring Root Protection to Enforce Root Bridge Placement in Spanning Trees

Note: This example uses Junos OS for SRX Series devices with support for the Enhanced Layer 2 Software (ELS) configuration style. For ELS details, see Getting Started with Enhanced Layer 2 Software.

SRX Series devices provide Layer 2 loop prevention through Spanning Tree Protocol (STP), Rapid Spanning Tree protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP). Root protection increases the efficiency of STP, RSTP, and MSTP by allowing network administrators to manually enforce the root bridge placement in the network.

This example describes how to configure root protection on an interface on a SRX Series device:

Requirements

• Junos OS Release 15.1X49-D70 or later
• Four SRX Series devices in an RSTP topology

• RSTP operating on the devices.

Overview

Peer STP applications running on device interfaces exchange a special type of frame called a bridge protocol data unit (BPDU). Devices communicate interface information using BPDUs to create a loop-free topology that ultimately determines the root bridge and which interfaces block or forward traffic in the spanning tree.

However, a root port elected through this process has the possibility of being wrongly elected. A user bridge application running on a PC can generate BPDUs, too, and interfere with root port election.

To prevent this from happening, enable root protection on interfaces that must not receive superior BPDUs from the root bridge and must not be elected as the root port. These interfaces are typically located on an administrative boundary and are designated ports.

When root protection is enabled on an interface:

• The interface is blocked from becoming the root port.
• Root protection is enabled for all STP instances on that interface.
• The interface is blocked only for instances for which it receives superior BPDUs. Otherwise, it participates in the spanning-tree topology.

Caution: An interface can be configured for either root protection or loop protection, but not for both.

In this example, they are configured for RSTP and create a loop-free topology. Interface ge-0/0/7 on device 1 is a designated port on an administrative boundary. It connects to device 4. Device 3 is the root bridge. Interface ge-0/0/6 on device 1 is the root port.

This example shows how to configure root protection on interface ge-0/0/7 to prevent it from transitioning to become the root port.

• The root port is responsible for forwarding data to the root bridge.
• The alternate port is a standby port for the root port. When a root port goes down, the alternate port becomes the active root port.
• The designated port forwards data to the downstream network segment or device.

This configuration example uses an RSTP topology. However, you also can configure root protection for STP or MSTP topologies at the [edit protocols mstp ] hierarchy level.

Configuration

To configure root protection on an interface:

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

Spanning tree interface parameters for instance 0

Interface    Port ID    Designated      Designated         Port    State  Role
                         port ID        bridge ID          Cost
ge-0/0/0     128:513      128:513  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/1     128:514      128:514  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/2     128:515      128:515  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/3     128:516      128:516  32768.0019e2503f00     20000  FWD    DESG 
ge-0/0/4     128:517      128:517  32768.0019e2503f00     20000  FWD    DESG 
ge-0/0/5     128:518        128:2  16384.00aabbcc0348     20000  BLK    ALT  
ge-0/0/6     128:519        128:1  16384.00aabbcc0348     20000  FWD    ROOT 
ge-0/0/7     128:520      128:520  32768.0019e2503f00     20000  FWD    DESG
[output truncated]
 

Spanning tree interface parameters for instance 0

Interface    Port ID    Designated      Designated         Port    State  Role
                         port ID        bridge ID          Cost
ge-0/0/0     128:513      128:513  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/1     128:514      128:514  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/2     128:515      128:515  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/3     128:516      128:516  32768.0019e2503f00     20000  FWD    DESG 
ge-0/0/4     128:517      128:517  32768.0019e2503f00     20000  FWD    DESG 
ge-0/0/5     128:518        128:2  16384.00aabbcc0348     20000  BLK    ALT  
ge-0/0/6     128:519        128:1  16384.00aabbcc0348     20000  FWD    ROOT 
ge-0/0/7     128:520      128:520  32768.0019e2503f00     20000  BLK    DIS (Root—Incon)
[output truncated]