ArubaOS-CX Loop Protection: Configure and Verify

A cabling loop that spanning tree is not protecting against will saturate an access switch in seconds, and on ArubaOS-CX spanning tree is disabled by default on many shipsets. Loop protection is the lightweight backstop: the switch transmits loop-detection packets on an interface and, if it receives its own packets back, disables the port before the loop can melt the network. This guide shows how to enable it per port, LAG, VLAN and VXLAN, what the actions actually do, and how to read the output when it fires at 3 a.m.

When to use loop protection instead of STP

Loop protection is not a replacement for RSTP/MSTP; it is a guard for segments where spanning tree is intentionally not running – edge/access ports, unmanaged switches in a lab, or downstream devices that filter BPDUs. It has no topology view: it detects only that a loop-detection frame came back, then takes the action you configured.

Enabling loop protection

switch(config)# interface 1/1/1
switch(config-if)# loop-protect
switch(config-if)# loop-protect action tx-rx-disable
switch(config-if)# exit

switch(config)# interface lag 25
switch(config-if)# loop-protect vlan 100-125,200
switch(config-if)# exit

switch(config)# loop-protect transmit-interval 30
switch(config)# loop-protect re-enable-timer 10

Key parameters:

• Scope – loop-protect on a port or LAG, and loop-protect vlan to restrict detection to specific VLANs (or use it on a VXLAN interface).
• Action – tx-disable is the default: the transmitting port is disabled. rx-disable disables the receiving side, and tx-rx-disable disables both, which is the safer choice on aggregate links where a one-sided disable leaves the loop path intact. Loop-protect action is not supported on VXLAN interfaces, where the default is rx-disable.
• transmit-interval – how often detection packets are sent (default 5 seconds in the CLI, commonly tuned to 30 on access ports to reduce chatter).
• re-enable-timer – how long the switch waits before bringing the interface back up, giving an operator time to find the cable.

Note the documented behaviour that all L2 ports have a default receiver action of tx-disable even when loop protection is not enabled – if you rely on a port staying up under odd traffic patterns, check this first.

Verifying and reading the output

switch# show loop-protect
Status and Counters - Loop Protection Information
  Transmit Interval      : 30 (sec)
  Port Re-enable Timer   : 10 (sec)
  Interface 1/1/1
    Loop-protect enabled : Yes
    Action on loop detection : TX disable
    Loop detected count  : 0
    Loop detected        : No
    Interface status     : up

A non-zero Loop detected count with Interface status: down means the guard worked and the port is being held down until the re-enable timer expires. Correlate with show interface, MAC learning tables and the event log to find where the loop actually is: a MAC address flapping between two ports, or thousands of MACs learned on a single access port, points at the rogue segment.

Pairing loop-protect with STP guards on access ports

interface 1/1/1
 no shutdown
 no routing
 vlan access 100
 loop-protect
 spanning-tree bpdu-guard
 spanning-tree port-type admin-edge
 spanning-tree tcn-guard

This is the common hardening template for an edge port: BPDU guard disables the port if someone plugs in a switch, port-type admin-edge makes it forward immediately instead of waiting through listening/learning, and tcn-guard stops a flapping edge port from flushing the topology for the whole VLAN. Loop protection then catches the case where BPDUs are filtered and the guard never sees them.

Troubleshooting loop events

• Port disabled, no visible loop – check for a downstream unmanaged switch or a patch panel miswire; the loop may be inside a wall outlet.
• Loops on a trunk – confirm STP is actually enabled for that VLAN and that the peers are not filtering BPDUs; verify native VLAN mismatch, which turns two trunks into one loop.
• Frequent re-enables – raise re-enable-timer so the port stays down long enough for someone to act, and enable traps/logging for loop events.

For the trunk-side verification commands, see ArubaOS-CX access and trunk VLAN verification and ArubaOS-CX VSF split detection. Spanning-tree design fundamentals are covered in spanning tree root bridge election.

原文链接：https://arubanetworking.hpe.com/techdocs/AOS-CX/10.13/HTML/l2_bridging_6300-6400/Content/Chp_loop_pro/cnf-loo-pro.htm