Spanning-Tree BPDUGuard

Hello Pinki

BPDU Guard is a feature that is enabled on ports where PortFast has been enabled. PortFast in turn should be enabled only on access ports, that is, ports that connect to end devices and not to other STP switches.

UplinkFast on the other hand is configured on ports that DO connect to other switches running STP. In actuality it is enabled ONLY on ports connected to switches.

For this reason, you would never configure both UplinkFast and BPDUGuard on the same port.

I hope this has been helpful!

Laz

I think the command should be SW2(config)#spanning-tree portfast bpduguard default
One last word missed in the guide.

Hi Dmitriy,

It seems they changed this. I’m looking at this document:

Cisco IOS Software Command
CatSwitch-IOS(config)# spanning-tree portfast bpduguard 
CatSwitch-IOS(config)

It seems that since the 3560, they use this command:

spanning-tree portfast bpduguard default

I’ll change it :+1:

Rene

Typically, in Rapid spanning tree, we would want to see the uplinkfast and backbone fast enabled correct? in which cases would you not want this enabled?

Thanks,
Austin

Hello Austin,
with Rapid STP we dont need to care about UplinkFast and BackboneFast any more, these features are natively included and automatically enabled in Rapid STP mode.

1 Like

Hello Austin

As @fugazz correctly stated, UplinkFast and BackboneFast are features that are natively included in RSTP. Actually, you will see that these two features will be reported as disabled on your output. This is because RSTP uses its own implementations of these improvements, and these are features that you cannot disable.

I hope this has been helpful!

Laz

1 Like

Hello NetworkLessons team.

I need help.
Portfast and BPDUGuard have been enabled on SW in the topology below.

image

Sometimes SW receive a BPDU in voice VLAN and the port goes into err-disabked state. What’s happened?

config example:

SW1#sh spanning-tree summary
Portfast Default             is enabled
PortFast BPDU Guard Default  is enabled
!
interface FastEthernet0/2
 switchport access vlan 6
 switchport mode access
 switchport voice vlan 3

Thanks.

Hello Boris

This is an unusual situation, but it is not unheard of. Specifically, in your configuration, you are protecting the network from someone connecting a switch to the PC port of the phone. The portfast and BPDU Guard features should both be enabled as you have them, as this is best practice for security. However, it seems that the switch is “seeing” BPDUs on the Fa0/2 port and going into err-disabled state.

There are several reasons why this would occur:

  1. Someone is connecting a switch to the PC port of the phone. Of course, I’m sure you’ve checked that, but just including this here for completion.
  2. There is some software running on the PC that is sending BPDUs. This would be the case if someone is trying to hack the network using specialized network tools, or if someone is running an emulator on the device using GNS3 for example. Some configuration may have sent some BPDUs over the physical network.
  3. Although rare, it has happened that faulty cables have caused problems with BPDU guard being tripped.

I suggest you check out the following:

  1. Verify that the err-disable reason is indeed due to BPDU Guard
  2. Is the problem reproducible? Do you see it on other ports with other phones? Try to switch cables, switch ports on the switch, and even disconnect the PC for a while and see if that makes any changes. This way you can focus on what is causing the problem (cable, PC, phone, switch port). By changing one element at a time, you can eliminate specific sources of the problem.

Try these out and let us know the results so we can further help you in troubleshooting…

I hope this has been helpful!

Laz

1 Like

Hello Laz
Thanks a lot.

1 Like