Example: Configuring Root Protection to Enforce Root Bridge Placement in Spanning Trees on EX Series Switches

Requirements

• Junos OS Release 9.1 or later for EX Series switches
• Four EX Series switches in an RSTP topology

• RSTP operating on the switches.

Note: By default, RSTP is enabled on all EX Series switches.

Overview and Topology

Peer STP applications running on switch interfaces exchange a special type of frame called a bridge protocol data unit (BPDU). Switches communicate interface information using BPDUs to create a loop-free topology that ultimately determines the root bridge and which interfaces block or forward traffic in the spanning tree.

However, a root port elected through this process has the possibility of being wrongly elected. A user bridge application running on a PC can generate BPDUs, too, and interfere with root port election.

To prevent this from happening, enable root protection on interfaces that should not receive superior BPDUs from the root bridge and should not be elected as the root port. These interfaces are typically located on an administrative boundary and are designated ports.

When root protection is enabled on an interface:

• The interface is blocked from becoming the root port.
• Root protection is enabled for all STP instances on that interface.
• The interface is blocked only for instances for which it receives superior BPDUs. Otherwise, it participates in the spanning-tree topology.

Caution: An interface can be configured for either root protection or loop protection, but not for both.

Four EX Series switches are displayed in Figure 1. In this example, they are configured for RSTP and create a loop-free topology. Interface ge-0/0/7 on Switch 1 is a designated port on an administrative boundary. It connects to Switch 4. Switch 3 is the root bridge. Interface ge-0/0/6 on Switch 1 is the root port.

This example shows how to configure root protection on interface ge-0/0/7 to prevent it from transitioning to become the root port.

Figure 1: Network Topology for Root Protection

Table 1 shows the components that will be configured for root protection.

A spanning tree topology contains ports that have specific roles:

• The root port is responsible for forwarding data to the root bridge.
• The alternate port is a standby port for the root port. When a root port goes down, the alternate port becomes the active root port.
• The designated port forwards data to the downstream network segment or device.

This configuration example uses an RSTP topology. However, you also can configure root protection for STP or MSTP topologies at the [edit protocols (mstp | stp)] hierarchy level.

Configuration

To configure root protection on an interface:

CLI Quick Configuration

To quickly configure root protection on interface ge-0/0/7, copy the following command and paste it into the switch terminal window:

Step-by-Step Procedure

Spanning tree interface parameters for instance 0

Interface    Port ID    Designated      Designated         Port    State  Role
                         port ID        bridge ID          Cost
ge-0/0/0.0     128:513      128:513  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/1.0     128:514      128:514  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/2.0     128:515      128:515  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/3.0     128:516      128:516  32768.0019e2503f00     20000  FWD    DESG 
ge-0/0/4.0     128:517      128:517  32768.0019e2503f00     20000  FWD    DESG 
ge-0/0/5.0     128:518        128:2  16384.00aabbcc0348     20000  BLK    ALT  
ge-0/0/6.0     128:519        128:1  16384.00aabbcc0348     20000  FWD    ROOT 
ge-0/0/7.0     128:520      128:520  32768.0019e2503f00     20000  FWD    DESG
[output truncated]
 

Spanning tree interface parameters for instance 0

Interface    Port ID    Designated      Designated         Port    State  Role
                         port ID        bridge ID          Cost
ge-0/0/0.0     128:513      128:513  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/1.0     128:514      128:514  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/2.0     128:515      128:515  32768.0019e2503f00     20000  BLK    DIS  
ge-0/0/3.0     128:516      128:516  32768.0019e2503f00     20000  FWD    DESG 
ge-0/0/4.0     128:517      128:517  32768.0019e2503f00     20000  FWD    DESG 
ge-0/0/5.0     128:518        128:2  16384.00aabbcc0348     20000  BLK    ALT  
ge-0/0/6.0     128:519        128:1  16384.00aabbcc0348     20000  FWD    ROOT 
ge-0/0/7.0     128:520      128:520  32768.0019e2503f00     20000  BLK    DIS (Root—Incon)
[output truncated]