spanning-tree portfast bpduguard default
Globally enables BPDU guard on all PortFast-enabled ports, automatically err-disabling a port if it receives a BPDU, protecting the spanning-tree topology from unauthorized switches.
Definition: spanning-tree portfast bpduguard default is a Cisco IOS global config command. Globally enables BPDU guard on all PortFast-enabled ports, automatically err-disabling a port if it receives a BPDU, protecting the spanning-tree topology from unauthorized switches.
Overview
The `spanning-tree portfast bpduguard default` command is a global configuration command on Cisco IOS that enables BPDU guard on all switch ports where PortFast is enabled. BPDU guard is a security feature that protects the spanning-tree topology from unauthorized switches or misconfigurations. When a PortFast-enabled port receives a Bridge Protocol Data Unit (BPDU), BPDU guard places the port into an err-disabled state, effectively shutting it down.
This prevents potential loops or topology changes caused by an unauthorized device (e.g., a rogue switch) connecting to an access port. The command is typically used on access ports that connect to end hosts, where PortFast is already configured to speed up convergence. Without BPDU guard, a malicious or accidental connection of a switch to such a port could cause a spanning-tree reconvergence, leading to network instability.
The command is applied globally, meaning it affects all ports with PortFast enabled, but it can be overridden on a per-interface basis using the `spanning-tree bpduguard enable` or `disable` interface command. This command is part of a broader security toolkit that includes root guard, loop guard, and BPDU filtering. BPDU guard is preferred when you want to ensure that access ports never receive BPDUs, while BPDU filtering (via `spanning-tree bpdufilter enable`) silently drops BPDUs without err-disabling the port.
The choice between guard and filter depends on whether you want to alert administrators via err-disable or silently ignore BPDUs. In a typical configuration workflow, you first enable PortFast globally or on interfaces, then enable BPDU guard globally to protect all such ports. The command takes effect immediately and is saved to the running configuration.
It does not require any additional parameters. The privilege level required is 15 (enable mode). The command is available in IOS 12.0 and later, and its behavior is consistent across IOS 15.x and 16.x.
In IOS-XE, the syntax is identical. The command does not produce any output; it simply modifies the running config. To verify, use `show spanning-tree summary` or `show running-config | include bpduguard`.
The global setting can be disabled with the `no spanning-tree portfast bpduguard default` command.
spanning-tree portfast bpduguard defaultWhen to Use This Command
- Prevent a rogue switch from being connected to an access port and causing a bridging loop.
- Automatically disable a port if an end-user accidentally connects a switch instead of a PC.
- Enforce security policy on all access ports without configuring BPDU guard per interface.
- Simplify deployment by enabling BPDU guard once globally for all PortFast ports.
Command Examples
Enable BPDU Guard Globally on All PortFast Ports
spanning-tree portfast bpduguard defaultNo output is generated; the command is applied silently. Use 'show running-config | include bpduguard' to verify.
Verify BPDU Guard Configuration
show running-config | include bpduguardspanning-tree portfast bpduguard default
The output confirms that BPDU guard is enabled globally. If the line is missing, the feature is not active.
Understanding the Output
This command does not produce direct output. To verify, use 'show running-config | include bpduguard' to see if the global command is present. To check if a specific port has been err-disabled due to BPDU guard, use 'show interfaces status err-disabled' or 'show interfaces <interface> status'.
Look for 'err-disabled' state and the reason 'bpduguard' in the output. A port in err-disabled state must be manually re-enabled with 'shutdown' followed by 'no shutdown' or automatically via errdisable recovery if configured.
Configuration Scenarios
Enable BPDU Guard Globally on All PortFast-Enabled Ports
A network administrator wants to secure all access ports on a switch that are configured with PortFast. By enabling BPDU guard globally, any port that receives a BPDU will be err-disabled, preventing unauthorized switches from connecting.
Topology
Switch1 (Gi0/1)---PC1
Switch1 (Gi0/2)---PC2
Switch1 (Gi0/3)---Unauthorized Switch (should be blocked)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enable PortFast globally on all access ports: spanning-tree portfast default
- 3.Step 3: Enable BPDU guard globally: spanning-tree portfast bpduguard default
- 4.Step 4: Exit configuration mode: end
- 5.Step 5: Verify the configuration: show spanning-tree summary
! Switch1(config)# spanning-tree portfast default Switch1(config)# spanning-tree portfast bpduguard default Switch1(config)# end
Verify: Use `show spanning-tree summary` to verify. Look for 'PortFast Default' and 'BPDU Guard Default' set to enabled. Example output: Switch1# show spanning-tree summary Switch is in pvst mode Root bridge for: none Extended system ID is enabled Portfast Default is enabled PortFast BPDU Guard Default is enabled Portfast BPDU Filter Default is disabled Loopguard Default is disabled ...
Watch out: If PortFast is not enabled globally or on the interface, BPDU guard will not take effect. Ensure PortFast is configured on the interfaces where you want BPDU guard to apply.
Override Global BPDU Guard on a Specific Interface
After enabling BPDU guard globally, a network administrator needs to allow a specific port to receive BPDUs (e.g., for a device that legitimately sends BPDUs like a switch in a lab). The global setting can be overridden on that interface.
Topology
Switch1 (Gi0/1)---PC1 (BPDU guard enabled)
Switch1 (Gi0/2)---Lab Switch (BPDU guard disabled)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enable PortFast and BPDU guard globally: spanning-tree portfast default; spanning-tree portfast bpduguard default
- 3.Step 3: Enter interface configuration mode for Gi0/2: interface gigabitethernet0/2
- 4.Step 4: Disable BPDU guard on this interface: no spanning-tree bpduguard enable
- 5.Step 5: Exit and verify: end; show spanning-tree interface gigabitethernet0/2
! Switch1(config)# spanning-tree portfast default Switch1(config)# spanning-tree portfast bpduguard default Switch1(config)# interface gigabitethernet0/2 Switch1(config-if)# no spanning-tree bpduguard enable Switch1(config-if)# end
Verify: Use `show spanning-tree interface gigabitethernet0/2` to verify. Look for 'Bpdu guard' line: it should show 'Pvlguard: Disabled' or similar. Example: Switch1# show spanning-tree interface gigabitethernet0/2 Vlan Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- ----------------------------- 1 Desg FWD 4 128.2 P2p Edge ... Bpdu guard: Disabled
Watch out: The interface-level command `spanning-tree bpduguard enable` is used to enable BPDU guard on a specific interface, but when the global default is enabled, you must use `no spanning-tree bpduguard enable` to disable it on that interface. Using `spanning-tree bpduguard disable` is not valid.
Troubleshooting with This Command
When troubleshooting BPDU guard issues, the primary symptom is a port that goes into err-disabled state. This is indicated by the interface status showing 'err-disabled' in `show interfaces status`. The reason for err-disable can be seen with `show interfaces status err-disabled`.
If BPDU guard caused the err-disable, the output will show 'bpduguard' as the cause. To recover, you can manually re-enable the port with `shutdown` followed by `no shutdown`, or configure err-disable recovery using `errdisable recovery cause bpduguard` and `errdisable recovery interval <seconds>`. Healthy operation means PortFast-enabled ports remain in forwarding state and never receive BPDUs.
If a port is expected to receive BPDUs (e.g., a trunk port), ensure PortFast is not enabled on that interface, or disable BPDU guard. A common mistake is enabling PortFast on trunk ports, which can cause loops. Use `show spanning-tree interface <interface>` to verify PortFast and BPDU guard status.
The 'Edge' flag indicates PortFast is enabled. If BPDU guard is enabled globally, it will show 'Bpdu guard: Enabled' unless overridden. To correlate with other commands, use `show logging` to see messages when a port is err-disabled due to BPDU guard.
The syslog message will say something like '%PM-4-ERR_DISABLE: bpduguard error detected on Gi0/1, putting Gi0/1 in err-disable state'. Also, `show spanning-tree summary` shows the global default status. If you suspect BPDU guard is not working, verify that PortFast is enabled on the interface (either globally or per-interface).
A step-by-step diagnostic flow: 1) Check interface status with `show interfaces status | include err-dis`. 2) If err-disabled, check cause with `show interfaces status err-disabled`. 3) If cause is bpduguard, check the connected device; it may be a switch sending BPDUs. 4) Decide whether to disable BPDU guard on that port or keep it err-disabled for security. 5) To recover, use `errdisable recovery cause bpduguard` and set a recovery interval. 6) Verify recovery with `show interfaces status`. If the port keeps going err-disabled, the connected device is still sending BPDUs; you may need to physically disconnect it.
CCNA Exam Tips
CCNA exam tip: BPDU guard is typically used with PortFast; remember that PortFast alone does not prevent loops, but BPDU guard does.
CCNA exam tip: When a port receives a BPDU with BPDU guard enabled, it goes into err-disabled state; you must manually re-enable it or configure errdisable recovery.
CCNA exam tip: The global command 'spanning-tree portfast bpduguard default' applies to all interfaces with PortFast enabled; you can also enable it per interface with 'spanning-tree bpduguard enable'.
CCNA exam tip: BPDU guard is a security feature; it does not affect normal STP operation on non-PortFast ports.
Common Mistakes
Mistake 1: Enabling BPDU guard globally without also enabling PortFast on access ports — BPDU guard only activates on PortFast-enabled ports.
Mistake 2: Forgetting that BPDU guard err-disables the port; administrators may not realize why the port is down and try to troubleshoot connectivity instead of checking for BPDU reception.
Mistake 3: Confusing BPDU guard with BPDU filter — BPDU filter prevents sending/receiving BPDUs, while BPDU guard disables the port upon BPDU reception.
spanning-tree portfast bpduguard default vs spanning-tree portfast
Both commands involve PortFast, but they operate at different levels. 'spanning-tree portfast' is an interface-level command that accelerates STP convergence on access ports, while 'spanning-tree portfast bpduguard default' is a global command that automatically enables BPDU guard on all PortFast-enabled interfaces. They are commonly confused because administrators may enable PortFast without considering the security implications, and BPDU guard adds protection.
| Aspect | spanning-tree portfast bpduguard default | spanning-tree portfast |
|---|---|---|
| Scope | Global (affects all PortFast-enabled interfaces) | Interface-specific (applied to a single port) |
| Configuration mode | Global configuration | Interface configuration |
| Persistence | Persistent across all PortFast ports unless overridden per-interface | Only on the specific interface; must be configured per port |
| Precedence | Can be overridden by per-interface BPDU guard configuration | Does not affect BPDU guard; separate command needed for guard |
| Effect on STP state | No direct effect on STP; triggers err-disable on BPDU reception | Bypasses Listening and Learning; immediate Forwarding |
| Typical use | Security measure on access ports to prevent rogue switch connections | On end-host ports to eliminate STP delay (30 sec) |
Use spanning-tree portfast bpduguard default when you want to automatically protect all PortFast-enabled ports from receiving BPDUs and err-disable them upon detection.
Use spanning-tree portfast when you have an end-host port that does not need STP convergence delays (e.g., PC, printer).
Platform Notes
In Cisco IOS-XE, the command syntax is identical to classic IOS: `spanning-tree portfast bpduguard default`. The output of `show spanning-tree summary` is similar but may include additional fields like 'Portfast Edge BPDU Guard Default' in newer versions. In NX-OS, the equivalent command is `spanning-tree portfast bpduguard default` under global configuration, but NX-OS uses a different spanning-tree implementation (MST or PVST+).
The behavior is the same: err-disables the port upon receiving a BPDU. However, NX-OS also supports `spanning-tree bpduguard enable` at the interface level. In IOS-XR, the command does not exist; instead, BPDU guard is configured per interface using `spanning-tree bpduguard` in interface configuration mode.
There is no global default for BPDU guard in IOS-XR. For ASA devices, spanning-tree is not typically used; instead, the ASA uses a different mechanism for loop prevention. In older IOS versions (12.x), the command may be available but the output format of `show spanning-tree summary` might differ slightly.
In IOS 15.x and 16.x, the command is fully supported. Note that in some IOS versions, the global command may be `spanning-tree portfast bpduguard` without the 'default' keyword, but the standard is with 'default'. Always check the documentation for your specific IOS version.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions