ExamFinch.com My Study

Study guide

4.2 Loop Protection and Diagnostic States

Practice this exam

JNCIS-ENT Enterprise Routing and Switching Study Guide 2026 Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Exam Overview & Junos Enterprise Fundamentals

1.1 JNCIS-ENT Exam Logistics & Blueprint Breakdown 1.2 Junos CLI, Enterprise Platforms & Interface Families 1.3 Layer 2 Bridging Mechanics & Packet Forwarding

2 Chapter 2: VLANs & Inter-VLAN Routing

2.1 VLAN Segmentation and 802.1Q Tags 2.2 Access, Trunk, Native and Voice VLANs 2.3 IRB Architecture and Interface Families 2.4 IRB Configuration and Packet Walk 2.5 VLAN Configuration, Verification & Troubleshooting

3 Chapter 3: Spanning Tree Protocols

3.1 Layer 2 Loops and Root Bridge Election 3.2 STP Costs, Port Roles, States and BPDUs 3.3 RSTP Rapid Convergence & Link Types 3.4 MSTP Architecture & Spanning Tree Operations

4 Chapter 4: Layer 2 Security & Feature Protection

4.1 Edge BPDU and Root Protection 4.2 Loop Protection and Diagnostic States 4.3 Port Security, MAC Limiting & Persistent MAC Learning 4.4 DHCP Snooping, Dynamic ARP Inspection (DAI) & IP Source Guard 4.5 Layer 2 Firewall Filters: Types, Order and Actions

5 Chapter 5: Advanced Layer 2 Features & Storm Control

5.1 Storm Control & Broadcast/Multicast Suppression 5.2 MACsec Link Security and Key Agreement 5.3 LLDP and LLDP-MED Operations & Verification

6 Chapter 6: Protocol-Independent Routing & Load Balancing

6.1 Static, Aggregate, and Generated Routes 6.2 Routing Instances and RIB Groups 6.3 Junos Load Balancing & Filter-Based Forwarding (FBF) 6.4 Martian Routes and Route Acceptance

7 Chapter 7: Junos Routing Policy & Firewall Filters

7.1 Routing Policy Framework & Term Evaluation 7.2 Prefix Lists & Route Filters 7.3 Firewall Filters & Policers

8 Chapter 8: Open Shortest Path First (OSPF) Operation

8.1 OSPF Architecture & Neighbor Adjacency Formation 8.2 OSPF Areas & LSA Types 8.3 OSPFv2 & OSPFv3 Configuration and Verification

9 Chapter 9: Advanced OSPF Features & Routing Policies

9.1 OSPF Special Area Types 9.2 Route Summarization & OSPF Authentication 9.3 OSPF Diagnostics & Common Failure Scenarios

10 Chapter 10: Intermediate System to Intermediate System (IS-IS)

10.1 IS-IS Encapsulation and NET Identity 10.2 IS-IS Levels, Areas and Default Routing 10.3 IS-IS PDU Families and Neighbor Exchange 10.4 IS-IS Database Synchronization and DIS 10.5 IS-IS Configuration, Metrics & Troubleshooting

11 Chapter 11: Border Gateway Protocol (BGP)

11.1 BGP Roles, AS Numbers and TCP Transport 11.2 EBGP/IBGP Sessions, State Machine and Messages 11.3 BGP Attributes & Junos Path Selection Algorithm 11.4 BGP Configuration & Policy Implementation 11.5 BGP Scaling with Route Reflection & Diagnostics

12 Chapter 12: IP Tunneling & High Availability

12.1 GRE & IP-IP Tunneling Architecture 12.2 Link Aggregation (LAG/LACP) & Redundant Trunk Groups (RTG) 12.3 Virtual Chassis Roles and Elections 12.4 Virtual Chassis Links, Splits and Provisioning 12.5 Routing Engine Redundancy: GRES, NSR, NSB and GR 12.6 BFD Detection and VRRP Gateway Redundancy 12.7 Unified ISSU: Requirements and Verification

4.2 Loop Protection and Diagnostic States

Key Takeaways Explain This Topic AI

Junos loop protection uses bpdu-timeout-action block on a port that should receive BPDUs.

A timeout-protected port stays nonforwarding when expected BPDUs disappear and recovers when valid BPDUs resume.

Root protection and loop protection are different mutually exclusive choices on an interface; inspect role and fault state before choosing one.

Last updated: October 2026

Loop Protect ( bpdu-timeout-action block )

In standard spanning tree operations, an Alternate (blocking) Port remains in the Discarding state only as long as it continuously hears periodic BPDUs from the designated bridge on that segment. If BPDUs stop arriving, the port's Max Age or Hello timer expires (3 missed Hellos in RSTP, equaling 6 seconds). Spanning tree assumes the upstream bridge has failed, and the Alternate Port transitions through Learning into the Forwarding state.

However, if the cessation of BPDUs is caused by a unidirectional link failure (e.g., an optical fiber break where the local switch can transmit but cannot receive, or an upstream switch CPU lockup that halts BPDU generation while hardware ASICs continue forwarding frames), transitioning the port to Forwarding creates a devastating, undetected Layer 2 loop!

Loop Protect solves this problem by validating that BPDUs continue to be received on non-designated (alternate/backup) ports and root ports.

Configuration in Junos OS

Loop Protect is enabled under the spanning tree protocol interface hierarchy: [edit protocols rstp interface ge-0/0/1.0]

  • user@EX4300# set bpdu-timeout-action block
  • Operational Mechanics & Loop-Inconsistent State

When bpdu-timeout-action block is active on an interface:

The switch expects to receive continuous BPDUs on the port.

If BPDUs cease arriving and the timer expires, Loop Protect prevents the port from transitioning to the Forwarding state.

Instead, Junos places the interface into a loop-inconsistent state.

In the loop-inconsistent state, the port remains in Discarding . User data traffic is dropped, and no Layer 2 loop can form.

Like Root Protect, Loop Protect features dynamic automatic recovery : once the unidirectional failure is repaired and valid BPDUs begin arriving again, the interface clears the loop-inconsistent condition and transitions into normal operation.

Comprehensive Comparison: BPDU Protect vs. Root Protect vs. Loop Protect

The following comparison matrix summarizes the key operational attributes, configuration commands, trigger conditions, resulting port states, and recovery behaviors across the three spanning tree protection features in Junos OS:

Feature Problem Solved Junos Configuration Hierarchy Trigger Condition Resulting Port State Recovery Mechanism

BPDU Protect Unauthorized switches or bridges attached to edge access ports [edit protocols rstp] set bpdu-block-on-edge (requires edge on the host-facing interface) Reception of any BPDU on an interface marked as edge Disabled (err-disabled) ; physical link drops Manual ( clear error bpdu interface ge-0/0/10 ) or automatic via disable-timeout

Root Protect Rogue switches usurping the Root Bridge role by advertising lower BIDs [edit protocols rstp interface <if>] set no-root-port Reception of a superior BPDU on a designated downstream port Root-Inconsistent (Discarding) ; drops data traffic Automatic ; port recovers when superior BPDUs cease

Loop Protect Unidirectional link failures causing non-designated ports to transition to forwarding [edit protocols rstp interface <if>] set bpdu-timeout-action block Cessation of incoming BPDUs on an alternate or root port Loop-Inconsistent (Discarding) ; drops data traffic Automatic ; port recovers when valid BPDUs resume

Spanning Tree Protection Operational Diagnostics

When troubleshooting spanning tree anomalies, engineers must verify whether an interface is blocked due to standard topology calculations or because a security protection mechanism has been triggered.

1. Verifying Interface Protection States: show spanning-tree interface

In operational mode, show spanning-tree interface displays the operational state and active protection flags: user@EX4300> show spanning-tree interface

Spanning tree interface parameters for instance 0

  • Interface Port ID Designated Designated Port State Role
  • port ID bridge ID Cost
  • ge-0/0/0.0 64:513 128:513 4096.000585112233 20000 FWD ROOT
  • ge-0/0/1.0 128:514 128:514 8192.000585aabbcc 20000 BLK ALT (LOOP-INC)
  • ge-0/0/10.0 128:523 128:523 8192.000585aabbcc 20000 BLK DESG (ROOT-INC)
  • ge-0/0/12.0 N/A N/A N/A N/A DISABLE DIS (BPDU-ERR)

In this output:

ge-0/0/1.0 has entered the BLK (Discarding) state flagged with (LOOP-INC) , indicating that Loop Protect has blocked the port because expected BPDUs stopped arriving.

ge-0/0/10.0 is flagged with (ROOT-INC) , indicating that Root Protect detected an unauthorized superior BPDU arriving on a port configured with no-root-port .

ge-0/0/12.0 shows state DISABLE with flag (BPDU-ERR) , indicating that BPDU Protect has disabled the interface following the arrival of a BPDU on an edge port.

2. Detailed Interface Diagnostics: show spanning-tree interface detail

To view granular diagnostic information, including protection flags and exact timer counters: user@EX4300> show spanning-tree interface ge-0/0/10.0 detail

  • Port name : ge-0/0/10.0
  • Port role : Designated
  • Port state : Discarding
  • Port ID : 128:523
  • Port cost : 20000
  • Port priority : 128
  • Designated bridge ID : 8192.000585aabbcc
  • Designated port ID : 128:523
  • Root protect : Enabled
  • Root protect status : Inconsistent (superior BPDU received)
  • Loop protect : Disabled
  • BPDU block on edge : Disabled
  • 3. Inspecting Error-Disabled Interfaces: show ethernet-switching port-error

To inspect all interfaces currently shut down by Layer 2 security mechanisms: user@EX4300> show ethernet-switching port-error

  • Interface Error Action Timeout (seconds)
  • ge-0/0/12.0 BPDU-error Disabled 185

This command displays the offending interface, the trigger condition ( BPDU-error ), the enforcement action ( Disabled ), and the remaining seconds before the automatic recovery timer re-enables the port.

Official references checked 2026-10-18: Loop protection .