Day21 STP BPDU Guard and BPDU Filter

1. BPDU Guard is a security feature that automatically disables (err-disables) a switch port if it receives a BPDU, protecting the network from unauthorized switches being connected to ports intended for end hosts.

2. BPDU Filter is a feature that prevents a port from sending BPDUs, and depending on configuration, may also ignore received BPDUs.

3. PortFast-enabled ports still participate in STP - they continue sending BPDUs and will revert to normal STP operation if they receive BPDUs from a neighbor.

4. ErrDisable Recovery is a feature that automatically re-enables err-disabled ports after a configurable time period (default 300 seconds/5 minutes).

5. BPDU Filter behaves differently depending on whether it's configured per-port (interface config mode) or by default (global config mode).

BPDU Guard

• Protects against unauthorized switches on end-host ports

• Port continues to send BPDUs

• If port receives a BPDU → enters err-disabled state

• Usually used together with PortFast

• When enabled by default → activates on all PortFast-enabled ports (NOT all access ports)

BPDU Filter

• Stops a port from sending BPDUs

• Per-port configuration: Ignores received BPDUs (effectively disables STP - DANGEROUS!)

• Global/default configuration: If BPDU received, PortFast and BPDU Filter are disabled, port operates normally

• Recommended to only enable by default (global config mode)

ErrDisable Recovery

• Disabled by default

• Default timer: 300 seconds (5 minutes)

• Must enable for specific causes (e.g., BPDU Guard)

• Always fix underlying problem first!

Numbers

BPDU Guard:

spanning-tree bpduguard enable (per-port)

spanning-tree portfast bpduguard default (global - enables on PortFast ports)

spanning-tree bpduguard disable (disable on specific port)

BPDU Filter:

spanning-tree bpdufilter enable (per-port - USE WITH CAUTION)

spanning-tree portfast bpdufilter default (global - RECOMMENDED)

spanning-tree bpdufilter disable (disable on specific port)

ErrDisable Recovery:

show errdisable recovery

errdisable recovery cause bpduguard

errdisable recovery interval <seconds>

Verification:

show spanning-tree interface <int> detail

show interfaces <int>

1. PortFast default vs BPDU Guard default behavior:

   • PortFast default → enables on all access ports

   • BPDU Guard default → enables on all PortFast-enabled ports

2. BPDU Filter per-port vs global:

   • Per-port = ignores BPDUs = disables STP = can cause permanent loops

   • Global/default = disables BPDU Filter if BPDU received = safer

3. BPDU Guard + BPDU Filter together:

   • BPDU Filter global + receives BPDU → BPDU Filter disabled → BPDU Guard triggers

   • BPDU Filter per-port + receives BPDU → BPDU ignored → BPDU Guard NOT triggered

4. Re-enabling err-disabled ports:

   • Must fix underlying issue first, or port will be disabled again immediately

Scenario: User connects unauthorized switch to wall jack

Without BPDU Guard:

• User's switch sends BPDUs

• Could become root bridge if lower priority

• Disrupts entire STP topology

• Traffic takes inefficient paths

With BPDU Guard:

• Port receives BPDU from user's switch

• Port immediately err-disables

• Network topology protected

• User complains "internet doesn't work" → IT investigates

It places the port in the err-disabled state, preventing it from sending or receiving any data.

500 seconds (5 minutes)

spanning-tree portfast bpduguard default

All PortFast-enabled ports (NOT all access ports)

Per-port: ignores received BPDUs (disables STP). Global: if BPDU received, BPDU Filter and PortFast are disabled, port operates normally.

errdisable recovery cause bpduguard

1) Manual: shutdown/no shutdown commands. 2) Automatic: ErrDisable Recovery feature.

It effectively disables STP on that port, which can cause permanent Layer 2 loops if connected to another switch.

Yes, PortFast only affects port state transitions; the port still sends BPDUs every 2 seconds.

spanning-tree bpdufilter enable (in interface config mode)

The BPDU is ignored by BPDU Filter, and BPDU Guard is NOT triggered. The port stays up.

BPDU Filter is disabled, then BPDU Guard is triggered, and the port is err-disabled.

show errdisable recovery

Fix the underlying problem that caused the err-disable, otherwise the port will be disabled again immediately.

Global config mode (spanning-tree portfast bpdufilter default) because it's safer - if a BPDU is received, the port reverts to normal STP operation instead of ignoring it.