4.2 Loop Protection and Diagnostic States

Key Takeaways

Junos loop protection uses bpdu-timeout-action block on a port that should receive BPDUs.
A timeout-protected port stays nonforwarding when expected BPDUs disappear and recovers when valid BPDUs resume.
Root protection and loop protection are different mutually exclusive choices on an interface; inspect role and fault state before choosing one.

Last updated: October 2026

Loop Protect (`bpdu-timeout-action block`)

In standard spanning tree operations, an Alternate (blocking) Port remains in the Discarding state only as long as it continuously hears periodic BPDUs from the designated bridge on that segment. If BPDUs stop arriving, the port's Max Age or Hello timer expires (3 missed Hellos in RSTP, equaling 6 seconds). Spanning tree assumes the upstream bridge has failed, and the Alternate Port transitions through Learning into the Forwarding state.

However, if the cessation of BPDUs is caused by a unidirectional link failure (e.g., an optical fiber break where the local switch can transmit but cannot receive, or an upstream switch CPU lockup that halts BPDU generation while hardware ASICs continue forwarding frames), transitioning the port to Forwarding creates a devastating, undetected Layer 2 loop!

Loop Protect solves this problem by validating that BPDUs continue to be received on non-designated (alternate/backup) ports and root ports.

Configuration in Junos OS

Loop Protect is enabled under the spanning tree protocol interface hierarchy:

[edit protocols rstp interface ge-0/0/1.0]
user@EX4300# set bpdu-timeout-action block

Operational Mechanics & Loop-Inconsistent State

When bpdu-timeout-action block is active on an interface:

The switch expects to receive continuous BPDUs on the port.
If BPDUs cease arriving and the timer expires, Loop Protect prevents the port from transitioning to the Forwarding state.
Instead, Junos places the interface into a loop-inconsistent state.
In the loop-inconsistent state, the port remains in Discarding. User data traffic is dropped, and no Layer 2 loop can form.
Like Root Protect, Loop Protect features dynamic automatic recovery: once the unidirectional failure is repaired and valid BPDUs begin arriving again, the interface clears the loop-inconsistent condition and transitions into normal operation.

Comprehensive Comparison: BPDU Protect vs. Root Protect vs. Loop Protect

The following comparison matrix summarizes the key operational attributes, configuration commands, trigger conditions, resulting port states, and recovery behaviors across the three spanning tree protection features in Junos OS:

Feature	Problem Solved	Junos Configuration Hierarchy	Trigger Condition	Resulting Port State	Recovery Mechanism
BPDU Protect	Unauthorized switches or bridges attached to edge access ports	`[edit protocols rstp] set bpdu-block-on-edge` (requires `edge` on the host-facing interface)	Reception of any BPDU on an interface marked as `edge`	Disabled (err-disabled); physical link drops	Manual (`clear error bpdu interface ge-0/0/10`) or automatic via `disable-timeout`
Root Protect	Rogue switches usurping the Root Bridge role by advertising lower BIDs	`[edit protocols rstp interface <if>] set no-root-port`	Reception of a superior BPDU on a designated downstream port	Root-Inconsistent (Discarding); drops data traffic	Automatic; port recovers when superior BPDUs cease
Loop Protect	Unidirectional link failures causing non-designated ports to transition to forwarding	`[edit protocols rstp interface <if>] set bpdu-timeout-action block`	Cessation of incoming BPDUs on an alternate or root port	Loop-Inconsistent (Discarding); drops data traffic	Automatic; port recovers when valid BPDUs resume

Spanning Tree Protection Operational Diagnostics

When troubleshooting spanning tree anomalies, engineers must verify whether an interface is blocked due to standard topology calculations or because a security protection mechanism has been triggered.

1. Verifying Interface Protection States: `show spanning-tree interface`

In operational mode, show spanning-tree interface displays the operational state and active protection flags:

user@EX4300> show spanning-tree interface

Spanning tree interface parameters for instance 0

Interface    Port ID    Designated    Designated         Port    State      Role
                          port ID     bridge ID          Cost
ge-0/0/0.0     64:513     128:513     4096.000585112233  20000   FWD        ROOT
ge-0/0/1.0    128:514     128:514     8192.000585aabbcc  20000   BLK        ALT (LOOP-INC)
ge-0/0/10.0   128:523     128:523     8192.000585aabbcc  20000   BLK        DESG (ROOT-INC)
ge-0/0/12.0       N/A         N/A                   N/A    N/A   DISABLE    DIS (BPDU-ERR)

In this output:

ge-0/0/1.0 has entered the BLK (Discarding) state flagged with (LOOP-INC), indicating that Loop Protect has blocked the port because expected BPDUs stopped arriving.
ge-0/0/10.0 is flagged with (ROOT-INC), indicating that Root Protect detected an unauthorized superior BPDU arriving on a port configured with no-root-port.
ge-0/0/12.0 shows state DISABLE with flag (BPDU-ERR), indicating that BPDU Protect has disabled the interface following the arrival of a BPDU on an edge port.

2. Detailed Interface Diagnostics: `show spanning-tree interface detail`

To view granular diagnostic information, including protection flags and exact timer counters:

user@EX4300> show spanning-tree interface ge-0/0/10.0 detail

  Port name                     : ge-0/0/10.0
  Port role                     : Designated
  Port state                    : Discarding
  Port ID                       : 128:523
  Port cost                     : 20000
  Port priority                 : 128
  Designated bridge ID          : 8192.000585aabbcc
  Designated port ID            : 128:523
  Root protect                  : Enabled
  Root protect status           : Inconsistent (superior BPDU received)
  Loop protect                  : Disabled
  BPDU block on edge            : Disabled

3. Inspecting Error-Disabled Interfaces: `show ethernet-switching port-error`

To inspect all interfaces currently shut down by Layer 2 security mechanisms:

user@EX4300> show ethernet-switching port-error

Interface        Error                Action            Timeout (seconds)
ge-0/0/12.0      BPDU-error           Disabled          185

This command displays the offending interface, the trigger condition (BPDU-error), the enforcement action (Disabled), and the remaining seconds before the automatic recovery timer re-enables the port.

Official references checked 2026-10-18: Loop protection.

Test Your Knowledge

Due to a physical fiber defect in an optical transceiving pair between two switches, a non-designated Alternate Port stops receiving periodic BPDUs from the upstream designated bridge while the transmit strand remains functional. If bpdu-timeout-action block is configured on this interface, how does Junos OS respond?

The interface initiates a rapid Proposal/Agreement handshake to negotiate a lower path cost with the upstream bridge.

The interface assumes the upstream bridge is dead and immediately transitions from Discarding to Forwarding after the Forward Delay timer expires.

The interface transitions to a loop-inconsistent state and remains in Discarding, preventing a catastrophic Layer 2 forwarding loop.

The interface automatically increases its bridge priority to 61440 and transmits a Topology Change Notification.

Sections you finish are checked off in the contents.

Up Next

4.3 Port Security, MAC Limiting & Persistent MAC Learning

Continue learning

JNCIS-ENT Enterprise Routing and Switching