Content

| 3.7 |  | Tuning, Verifying, and Troubleshooting Spanning-Tree Protocol |
| 3.7.4 |  | Configuring BPDU guard |

When BPDU guard is enabled globally on ports that are Port Fast-enabled (the ports are in a Port Fast-operational state), spanning tree shuts down Port Fast-enabled ports that receive BPDUs.

In a valid configuration, PortFast enabled ports do not receive BPDUs. Receiving a BPDU on a PortFast-enabled port signals an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the port in the error-disabled state. The BPDU guard feature provides a secure response to invalid configurations because the port must be manually put back in service. Use the BPDU guard feature in a service-provider network to prevent an access port from participating in the spanning tree.

Configure PortFast only on ports that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt switch and network operation.

Use the spanning-tree bpduguard enable interface configuration command to enable BPDU guard on any port without also enabling the Port Fast feature. When the port receives a BPDU, it is put in the error-disabled state.

The BPDU guard feature can be enabled if the switch is running PVST or MSTP. The MSTP is available only if the EI is installed on the switch.

Beginning in privileged EXEC mode, follow the steps outlined in Figure to globally enable the BPDU guard feature.

To disable BPDU guard, use the no spanning-tree portfast bpduguard default global configuration command.

The setting of the no spanning-tree portfast bpduguard default global configuration command can be overridden by using the spanning-tree bpduguard enable interface configuration command.