Cisco Loop Protection

We are replacing some Extreme switches with Cisco 2960S-48 switches.

We ran ELRP on the Extreme switches to prevent loops.

Looking at the Cisco options I am a bit confused as to what option to use or multiple options.

I read that BPDU guard may not be enough to prevent loops.  Maybe the storm control should be used.  Loop guard ? UDLD ?

Here is the environment:
Several engineers hardware/software  have small desktop switches as they plug in numerous devices and I don't want to limit the MAC count.  

Two 1 Gig GBICS with be used as Etherchannel to the core.

Portfast on
Most user ports are access mode with a default vlan, data, and voice.

My main concern is to prevent users from looping the network with small switches.  We also have the occasional person  moving desks looping by plugging things in wrong.

UDLD and BPDU guard?

Example switch port or trunk port config ?
Thanks in advance
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

I always found Bpdu guard to be sufficient, but looping in the small switches would have to be tested as I've not experimented with that configuration. Can you not increase the number of data ports to bypass the need for the switches?
PostQAuthor Commented:
A lot of the time that just becomes another budget item since we could not pick and chose who gets them.  It would be to run 2-4 more drops for each person, add more Cisco switches, and then only about 20% of the employees would need them.  As of now out of about 60 engineers 10-15 use the small switches on occasion.  ELRP running on the Extreme switches worked great.  Maybe I will test the BPDU.  I think another blog mentioned using UDLD on trucks to the core since we have fiber ports running Etherchannel.  I think it advised against loop guard since it would take down both Etherchannels where as UDLD would just drop one fiber connection and the second should work.  Small switches or not, I would like to have some sort of loop protection like Extreme ELRP.
AkinsdNetwork AdministratorCommented:
Udld works on uni directional connections like fiber as the name implies ( Uni Directional Link Detection). Fiber has 1 port sending and the other port receiving. When on port fails, spanning tree enables alternate port which may cause a loop because the other half of the failed fiber connection is still active. Udld ensures that the other half is disabled if one half fails

Spanning tree with bpdu guard should be sufficient. Since you have port fast enabled, do not use bpdu filter as that will convert to standard stp operation if bpdu is detected on the port. Bpdu guard on the other hand will disable the port to prevent loop. Also, hard code your access layer switch ports as access ports. Consider nonnegotiate option also.

You should only worry about loops on your up links
Powerful Yet Easy-to-Use Network Monitoring

Identify excessive bandwidth utilization or unexpected application traffic with SolarWinds Bandwidth Analyzer Pack.

PostQAuthor Commented:
So I will use UDLD on the 2 Etherchannel fiber trunks, and bpdu guard on the hard coded access ports?    Your last statement has me leaning toward applying nothing on the user ports, but I do want to halt user created loops.
Soulja53 6F 75 6C 6A 61 Commented:
You can use UDLD on trunks whether fiber or copper, but most of the time on fiber.

On your access ports, enable portfast, bpdu guard, and you can enable port security to limit mac addresses on the interfaces to one MAC address. This way small switches will be somewhat ineffective for users trying to connect multiple devices to a port.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
AkinsdNetwork AdministratorCommented:
You can use udld on copper but it has no effect

Hard coding access ports prevents loops automatically as the ports do not send dtp packets and can never form a trunk. Loops are only formed on trunk ports
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking Hardware-Other

From novice to tech pro — start learning today.