How to detect loops created by unmanaged switches?

Question

Is there a way to detect unmanaged switches that are connected on access ports?

In a spanning tree trunking managed network I look at bpdu errors on ports which usually indicate an unmanaged switch as a PC should not sent these.

I also look at logs that indicate that a switch is running low on resources as a loops can overload the CPU if it's not detected.

Do you know of any other or better ways?

I am primarily interested in solutions that work with Cisco and Juniper but a vendor agnostic approach would be also welcome.

I am asking as access ports use two vlans (data and voice) and any frames sent through unmanaged switches lose the voice vlan tag which causes problems with the phones.

Answer 1

Preventing Unmanaged Switches and Loops:

The best solution would be to block unmanaged switches entirely, except those that you explicitly allow. This can be done by enabling bpduguard on access ports, which would disable any port that receives a bpdu packet.

Example:

CISCO: Switch(config-if)#spanning-tree bpduguard enable
JUNIPER: user@switch# set ethernet-switching-options bpdu-block interface ge-0/0/0.0 shutdown

If there are unmanaged switches on your network that you would like to keep but protect STP and prevent loops you could enable a feature called root guard. This would allow that port to still receive bpdu packets, but it would not forward those that try to alter STP.

Example:

CISCO: Switch(config-if)# spanning-tree guard root
JUNIPER: user@switch# set protocols rstp interface ge-0/0/7 no-root-port

Limit the number of MAC addresses or whitelist MAC addresses on switch ports.

Example:

CISCO: switch(config-if)# switchport port-security maximum 2
     Switch(config-if)# switchport port-security mac-address 0000.000.000.0000

JUNIPER: user@switch# set interface ge-0/0/1 mac-limit 10
user@switch# set interface ge–0/0/2 allowed-mac 00:00:00:00:00:00

Detecting Unmanaged Switches:

Method 1: View the MAC address table, if you see multiple machines connecting on a single port, that is a pretty good indication that their is a switch connected to that port.

Method 2: Look for ports running STP

Example:

Switch# show spanning-tree vlan 1-4094 | inc STP

Method 3: Using Cisco Debug to see which ports are receiving bpdu's

Example:

CISCO: Switch# debug spanning-tree bpdu receive
JUNIPER: user@switch> show spanning-tree statistics interface

Answer 2

Typically, an unmanaged switch wouldn't send BPDU's, since it won't support spanning-tree. So you can only see your own BPDU's coming back to you on another port then. If you're running spanning-tree, you can use a BPDU guard on Cisco to stop the loop by shutting down the interface:

interface GigabitEthernet0/1
  spanning-tree bpduguard enable

On Juniper:

set rstp bpdu-block-on-edge interface ge-0/0/0.0 edge

Another way to monitor and prevent them is by implementing storm control, which can help you to detect and stop broadcast, multicast and unknown unicast floods.

Both Cisco and Juniper support this. On Cisco, you can use:

interface GigabitEthernet0/1
  storm-control broadcast level 0.01

The level here indicates the percentage of the total interface bandwidth which can be used for broadcast/multicast/unknown unicast traffic. You can then set an action on what happens when this level is exceeded:

storm-control action shutdown

To shut the port. Or,

storm-control action trap

To send a SNMP trap (see below for more about this).

On Juniper you can use:

set ethernet-switching-options storm-control action-shutdown

On Juniper, the command is:

set ethernet-switching-options storm-control interface xe-0/0/0 bandwidth 1000

The rate is in Kbps.

If you want to be more proactive, you can consider configuring SNMP traps for spanning-tree and storm control events. Your switches can then send trap messages to a central SNMP trap server when a loop occurs.This SNMP trap server can then send you an alert (via mail, SMS, IRC, or whatever you have in place).

On Cisco you can configure SNMP traps like this:

snmp-server enable traps port-security

On Juniper:

set snmp trap-group GROUPNAME link