15-4
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Chapter 15 Configuring STP Features
Overview of BPDU Guard
Note Because the purpose of PortFast is to minimize the time that access ports must wait for spanning tree to
converge, it is most effective when used on access ports. If you enable PortFast on a port connecting to
another switch, you risk creating a spanning tree loop.
Overview of BPDU Guard
Spanning Tree BPDU guard shuts down PortFast-configured interfaces that receive BPDUs, rather than
putting them into the spanning tree blocking state. In a valid configuration, PortFast-configured
interfaces do not receive BPDUs. Reception of a BPDU by a PortFast-configured interface signals an
invalid configuration, such as connection of an unauthorized device. BPDU guard provides a secure
response to invalid configurations, because the administrator must manually put the interface back in
service.
Note When the BPDU guard feature is enabled, spanning tree applies the BPDU guard feature to all
PortFast-configured interfaces.
Overview of PortFast BPDU Filtering
Cisco IOS Release 12.2(25)EW and later support PortFast BPDU filtering, which allows the
administrator to prevent the system from sending or even receiving BPDUs on specified ports.
When configured globally, PortFast BPDU filtering applies to all operational PortFast ports. Ports in an
operational PortFast state are supposed to be connected to hosts that typically drop BPDUs. If an
operational PortFast port receives a BPDU, it immediately loses its operational PortFast status. In that
case, PortFast BPDU filtering is disabled on this port and STP resumes sending BPDUs on this port.
PortFast BPDU filtering can also be configured on a per-port basis. When PortFast BPDU filtering is
explicitly configured on a port, it does not send any BPDUs and drops all BPDUs it receives.
Caution Explicitly configuring PortFast BPDU filtering on a port that is not connected to a host can result in
bridging loops, because the port will ignore any BPDU it receives and go to the forwarding state.
When you enable PortFast BPDU filtering globally and set the port configuration as the default for
PortFast BPDU filtering (see the “Enabling PortFast BPDU Filtering” section on page 15-12), PortFast
enables or disables PortFast BPDU filtering.
If the port configuration is not set to default, then the PortFast configuration will not affect PortFast
BPDU filtering. Table 15-1 lists all the possible PortFast BPDU filtering combinations. PortFast BPDU
filtering allows access ports to move directly to the forwarding state as soon as the end hosts are
connected.
To Next Page
Loading...
Need help?
General
