Does Loop Protect Protocol work with Port-Security?

Question

I'm working for a company which wants to change its network equipment.

We are changing old aruba by aruba 6100. We are also changing network link, we remove network interconnection and we connect the switches to two network cores with fibres.

We don't need STP anymore, so I'm configuring Loop-Protect on every switches to prevent network Loop. I also want to increase the network security by implanting Mac port-Secuirty.

The problem is when I configure Port-Security on every port, Loop-Protect doesnt detect any loop anymore. When I disable Port-Security, it works again.

My conclusion is that Loop-Protection doesn't work with Port-Security, is that normal ?

Update : i wanted to test loop protection with STP BPDU Guard. It works well, like Loop-Protect. But same thing, when I use port-access port-security enable, loops are no more detected. It feels like port-security is locking every loop detection protocol

Answer 1

By logic, port-level security makes active loop detection pretty much gratuitous. Loop detection is designed to detect and disable loops created by accident or maliciously - both are very hard (if not impossible) to accomplish with proper port-level security.

However, I'd recommend leaving RSTP/MSTP enabled as it doesn't hurt and can save you one day. Just secure access ports with Root Guard, TCN Guard and optionally BPDU Guard to avoid network disruptions.

The only drawback of STP vs (probe) loop detection is that STP cannot detect remote loops behind intermediate switches which filter BPDUs and don't participate in STP. Otherwise it should be considered as generally superior.