Content

| 3.5 |  | Evolution of Spanning Tree |
| 3.5.5 |  | Switchport tuning using BPDU guard |

STP configures a meshed topology into a loop-free, tree-like topology. When the link on a bridge port goes up, there is STP calculation done on that port. The result of the calculation will be the transition of the port into forwarding or Blocking state, depending on the position of the port in the network, and the STP parameters. This calculation and transition period usually takes about 30-50 seconds. At this time, no user data is passing via the port. Some user applications may timeout during this period.

To allow immediate transition of the port into Forwarding state, the STP PortFast feature is enabled. PortFast transitions the port into STP forwarding mode immediately upon linkup. The port still participates in STP in the event that the port is to be a part of a loop, if so it will eventually transition into STP blocking mode.

As long as the port is participating in STP, there is a possibility that some device attached to that port and also running STP with lower bridge priority than that of the current root bridge, will assume the root bridge function and affect active STP topology, thus rendering the network suboptimal. Permanent STP recalculation caused by the temporary introduction and subsequent removal of STP devices with low (zero) bridge priority represents a simple form of Denial of Service (DoS) attack on the network.

The STP PortFast BPDU guard enhancement is designed to allow network designers to enforce the STP domain borders and keep the active topology predictable. The devices behind the ports with STP PortFast enabled are not allowed to influence the STP topology. This is achieved by disabling the port with PortFast configured upon reception of BPDU. The port is transitioned into Errdisable state, and a message is printed on the console. The following is an example of the message printed out as a result of BPDU guard operation:

> 2000 May 12 15:13:32 %SPANTREE-2-RX_PORTFAST:Received BPDU on PortFast enable port. Disabling 2/1

> 2000 May 12 15:13:32 %PAGP-5-PORTFROMSTP:Port 2/1 left bridge port 2/1

In Figure , bridge A has priority 8192 and is the root for the VLAN. Bridge B has priority 16384 and is the backup root bridge for the same VLAN. Bridges A and B, connected by a Gigabit Ethernet link, make up a core of the network. Bridge C is an access switch and has PortFast configured on the port connected to device D. Given the other STP parameters being default, bridge C port that connects to bridge B will be in STP Blocking state. Device D (PC) is not participating in STP. The red arrows indicate the flow of STP BPDUs.

Now, consider that device D started to participate in STP (for example, a Linux-based bridge application was launched on a PC). If the priority of software bridge is zero or any value below that of root bridge, the software bridge will take over the root bridge function (as bridge with lowest priority), and the Gigabit link connecting the two core switches will transition into blocking mode, thus causing all the data in that particular VLAN to flow via the 100 Mbps link. If there is more data flowing via the core in the VLAN than the link can accommodate, the dropping of frames will occur, leading to a connectivity outage. STP PortFast BPDU guard feature would prevent such a situation by disabling the port as soon as STP BPDU is received from device D.