0

I'm working for a company which wants to change its network equipment.

We are changing old aruba by aruba 6100. We are also changing network link, we remove network interconnection and we connect the switches to two network cores with fibres.

We don't need STP anymore, so I'm configuring Loop-Protect on every switches to prevent network Loop. I also want to increase the network security by implanting Mac port-Secuirty.

The problem is when I configure Port-Security on every port, Loop-Protect doesnt detect any loop anymore. When I disable Port-Security, it works again.

My conclusion is that Loop-Protection doesn't work with Port-Security, is that normal ?

Update : i wanted to test loop protection with STP BPDU Guard. It works well, like Loop-Protect. But same thing, when I use port-access port-security enable, loops are no more detected. It feels like port-security is locking every loop detection protocol

6
  • 1
    I don’t know Aruba equipment very well, but I don’t see any reason to turn off STP.
    – Ron Trunk
    Sep 28, 2021 at 10:04
  • Why would I let it ON if I don't have any interconnection.
    – Netexis
    Sep 28, 2021 at 10:30
  • I, as well, don’t know Aruba gear that well, and I’m just as confused about why you don’t think you should use STP. There are very few scenarios that justify not using it, so I’m interested to know what yours is.
    – Jesse P.
    Sep 28, 2021 at 10:31
  • I'm using LACp to connect my switch to the core, the only thing that could interest me in STP would be Loop Protection, which his 1 of the mutiple STP function. Or I could just use Loop-Protection which is a Protocol make only for this.
    – Netexis
    Sep 28, 2021 at 10:39
  • @Netexis There are several other benefits of using STP. There’s loop protection, of course, but there’s also root protection, BPDU guard, making certain VLANs the roots on specific switches that may be where certain systems are at, shortening the path, etc.
    – Jesse P.
    Sep 28, 2021 at 12:11

1 Answer 1

1

By logic, port-level security makes active loop detection pretty much gratuitous. Loop detection is designed to detect and disable loops created by accident or maliciously - both are very hard (if not impossible) to accomplish with proper port-level security.

However, I'd recommend leaving RSTP/MSTP enabled as it doesn't hurt and can save you one day. Just secure access ports with Root Guard, TCN Guard and optionally BPDU Guard to avoid network disruptions.

The only drawback of STP vs (probe) loop detection is that STP cannot detect remote loops behind intermediate switches which filter BPDUs and don't participate in STP. Otherwise it should be considered as generally superior.

7
  • Thanks for your answer. I guess i'm goint to let RSTP on switches... When I enable port-security, it dosent detect loops, I don't think thats normal that loop protect dosent work when port-security is enable.
    – Netexis
    Sep 28, 2021 at 13:05
  • @Netexis Have you attempted to contact Aruba support to make sure this is expected behavior?
    – Jesse P.
    Sep 28, 2021 at 15:00
  • That's what I am going to do, I want to be sure thats not a bug
    – Netexis
    Sep 28, 2021 at 15:10
  • 1
    I guess it's intentional since it doesn't make too much sense. Needs to be documented properly, but that's not really HPE's strong side...
    – Zac67
    Sep 28, 2021 at 16:08
  • 1
    @kayaatabey Most unmanaged switches don't comply to 802.1D, so they forward BPDUs, making them transparent for STP. Having a managed switch not participating in STP and having a loop behind that is a real danger, yes. With MAC port security any switch requires a permitted node connected to it to work in any case. Loop protection works across ports as well.
    – Zac67
    Oct 2, 2021 at 7:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.