spanning-tree portfast
Speed up host connectivity by skipping STP convergence on ports that connect to PCs, printers, and servers rather than other switches.
Definition: spanning-tree portfast is a Cisco IOS interface config command. Bypasses the STP Listening and Learning states on a port, moving it directly to Forwarding after the link comes up. Eliminates the default 30-second STP convergence delay for ports connected to end hosts.
Overview
The `spanning-tree portfast` command is a critical interface-level configuration in Cisco IOS that enables PortFast on a switch port. PortFast allows a port to transition directly from the blocking state to the forwarding state, bypassing the normal Spanning Tree Protocol (STP) listening and learning phases. This is essential for access ports connected to end devices such as PCs, printers, or IP phones, where rapid convergence is desired to avoid delays in network connectivity.
Without PortFast, a port would take approximately 30 seconds (15 seconds for listening, 15 seconds for learning) to become active, which can cause timeouts for DHCP requests or other latency-sensitive applications. The command is typically applied to ports that are known to be edge ports—ports that will never connect to another switch or bridge. By enabling PortFast, the switch immediately places the port into forwarding state, but it still participates in STP; if a BPDU is received on a PortFast-enabled port, the port will revert to normal STP behavior and may transition to blocking state if a loop is detected.
This behavior is known as PortFast BPDU guard, which can be enabled globally or per interface to protect against accidental loops. The command is configured in interface configuration mode and requires privilege level 15 (enable mode). It is saved to the running configuration and can be written to startup configuration.
Alternatives include using the `spanning-tree portfast default` global command to enable PortFast on all access ports, or using `spanning-tree portfast trunk` to enable it on trunk ports (though this is less common and requires caution). In a broader network configuration workflow, PortFast is often combined with other STP enhancements like BPDU guard, root guard, or loop guard to create a robust edge port security posture. For troubleshooting, verifying PortFast status is done with `show spanning-tree interface <interface> portfast` or `show running-config interface <interface>`.
The command is available in all IOS versions, including IOS-XE, and has equivalents in NX-OS and IOS-XR. Understanding PortFast is fundamental for CCNA and CCNP candidates, as it directly impacts network convergence and user experience in campus networks.
spanning-tree portfast [disable | trunk]When to Use This Command
- Prevent 30-second DHCP timeout on PC boot caused by STP convergence delay
- Required on all access ports in any modern switched network
- Used with BPDU Guard to protect the port from accidental switch connections
- Enable on trunk ports to VMs in virtualised environments (portfast trunk)
Command Examples
Enable PortFast with BPDU Guard on an access port
Switch(config)# interface GigabitEthernet1/0/1 Switch(config-if)# spanning-tree portfast Switch(config-if)# spanning-tree bpduguard enable Switch(config-if)# end %SPANTREE-2-PORTFAST_PORTTYPE_CHANGE: Edge port type changed to Edge on GigabitEthernet1/0/1 because all it's ports are not connected to the rest of the network
Understanding the Output
IOS logs a message confirming the port is now an 'Edge port' in STP. The port transitions directly to Forwarding when the link comes up instead of waiting 15s Listening + 15s Learning. show spanning-tree interface <id> portfast shows 'Port Type: Edge' when PortFast is active.
Configuration Scenarios
Enable PortFast on an access port for a PC
A switch port connected to a desktop PC is experiencing delays in obtaining an IP address via DHCP because STP listening and learning phases cause a 30-second delay. Enabling PortFast will allow the port to forward traffic immediately, reducing boot time and preventing DHCP timeouts.
Topology
PC1---(Gi0/1)SW1Steps
- 1.Step 1: Enter global configuration mode: SW1# configure terminal
- 2.Step 2: Enter interface configuration mode for the port: SW1(config)# interface GigabitEthernet0/1
- 3.Step 3: Enable PortFast: SW1(config-if)# spanning-tree portfast
- 4.Step 4: Optionally enable BPDU guard for protection: SW1(config-if)# spanning-tree bpduguard enable
- 5.Step 5: Exit and verify: SW1(config-if)# end
! Full IOS config block SW1# configure terminal SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree bpduguard enable SW1(config-if)# end
Verify: Use `show spanning-tree interface GigabitEthernet0/1 portfast` to verify. Expected output: 'PortFast is enabled' or 'PortFast is configured'.
Watch out: If the port receives a BPDU after PortFast is enabled, it will revert to normal STP and may block the port. Always enable BPDU guard on PortFast ports to prevent accidental loops.
Enable PortFast on a trunk port for a server with multiple VLANs
A server connected via a trunk port needs to be reachable immediately after link up. While PortFast is typically for access ports, it can be applied to trunk ports using the `spanning-tree portfast trunk` command. This is useful for servers that are not expected to participate in STP.
Topology
Server---(Gi0/2, trunk)SW1Steps
- 1.Step 1: Enter global configuration mode: SW1# configure terminal
- 2.Step 2: Enter interface configuration mode: SW1(config)# interface GigabitEthernet0/2
- 3.Step 3: Configure the interface as a trunk: SW1(config-if)# switchport mode trunk
- 4.Step 4: Enable PortFast on trunk: SW1(config-if)# spanning-tree portfast trunk
- 5.Step 5: Exit and verify: SW1(config-if)# end
! Full IOS config block SW1# configure terminal SW1(config)# interface GigabitEthernet0/2 SW1(config-if)# switchport mode trunk SW1(config-if)# spanning-tree portfast trunk SW1(config-if)# end
Verify: Use `show spanning-tree interface GigabitEthernet0/2 portfast` to verify. Expected output: 'PortFast is enabled' or 'PortFast is configured'.
Watch out: Enabling PortFast on a trunk port is risky if the trunk connects to another switch. Only use this on trunks to end devices like servers or routers that do not run STP. Always consider using BPDU guard for protection.
Troubleshooting with This Command
When troubleshooting PortFast, the primary command is `show spanning-tree interface <interface> portfast`. Healthy output indicates 'PortFast is enabled' or 'PortFast is configured'. If the output shows 'PortFast is disabled', the port is not configured with PortFast.
Another useful command is `show running-config interface <interface>` to confirm the configuration line `spanning-tree portfast` is present. If a port is expected to be in forwarding state but remains in blocking or listening state, check if a BPDU was received. Use `show spanning-tree interface <interface> detail` to see the port state and whether BPDU guard has disabled the port.
Common symptoms that PortFast helps diagnose include slow DHCP address assignment, delays in network boot (PXE), or timeouts during initial connectivity. If a port configured with PortFast is not forwarding, check for BPDU guard errdisable state using `show interfaces status err-disabled`. To recover, use `shutdown` followed by `no shutdown` on the interface.
Another diagnostic flow: first verify the port is an access port (or trunk if PortFast trunk is used) with `show interfaces switchport`. Then confirm PortFast is enabled. If the port is still slow, check for STP recalculation due to topology changes using `show spanning-tree detail` and look for 'Topology change' flags.
Correlate with `debug spanning-tree events` (use with caution) to see real-time STP transitions. For BPDU guard issues, `show spanning-tree interface <interface> detail` will show 'Bpdu guard is enabled' and 'Portfast is enabled'. If the port is in errdisable, the output will indicate 'errdisable' state.
In summary, PortFast troubleshooting revolves around verifying configuration, checking for BPDU reception, and ensuring no errdisable conditions exist.
CCNA Exam Tips
CCNA exam: PortFast is safe ONLY on ports connected to end hosts, never on ports to other switches
BPDU Guard is the companion feature that err-disables a PortFast port if it receives a BPDU (indicating a switch was connected)
Enable PortFast globally with spanning-tree portfast default (applies to all access ports) or per-interface
Common Mistakes
Enabling PortFast on a port connected to another switch — creates switching loops if STP topology changes
Not pairing PortFast with BPDU Guard — a user plugging in a cheap switch creates a loop risk
Confusing PortFast (STP edge port) with RSTP edge port — they are conceptually the same, different terminology
spanning-tree portfast vs switchport mode access
These two commands are commonly used together on access ports connecting end hosts, but they address different concerns: 'spanning-tree portfast' accelerates STP convergence, while 'switchport mode access' forces the port to operate as an access port, disabling trunk negotiation. Understanding their distinct roles prevents misconfiguration and potential network issues.
| Aspect | spanning-tree portfast | switchport mode access |
|---|---|---|
| Scope | Per-interface | Per-interface |
| Configuration Mode | Interface configuration | Interface configuration |
| Persistence | Persistent in running-config | Persistent in running-config |
| Effect on VLAN/Trunking | No effect on VLAN or trunking | Sets port as nontrunking, single VLAN |
| Typical Use Case | End-host ports to avoid STP delay | End-host ports for VLAN membership |
| Risk | Potential loops if used on switch-facing ports | Prevents accidental trunk formation |
Use spanning-tree portfast when connecting end hosts (workstations, servers) to reduce the 30-second STP convergence delay on the port.
Use switchport mode access when you need to statically assign a port to a single VLAN and disable all Dynamic Trunking Protocol (DTP) negotiation.
Platform Notes
In IOS-XE, the `spanning-tree portfast` command syntax and behavior are identical to classic IOS. However, IOS-XE may have additional features like `spanning-tree portfast network` for network ports (though this is less common). In NX-OS, the equivalent command is `spanning-tree port type edge` under interface configuration mode.
For example: `interface ethernet 1/1; spanning-tree port type edge`. NX-OS also supports `spanning-tree port type edge default` globally. In IOS-XR, the command is `spanning-tree portfast` under interface configuration, but note that IOS-XR uses a different STP implementation (MSTP by default) and the command may be available only in certain releases.
For ASA devices, STP is not typically used; instead, ASA uses redundant interfaces with failover. There are no significant differences between IOS 12.x, 15.x, and 16.x for this command; it remains consistent. However, in newer IOS versions, the `spanning-tree portfast` command may automatically enable BPDU guard if configured globally with `spanning-tree portfast bpduguard default`.
Always check the specific IOS version documentation for any nuances.
Related Commands
ip dhcp snooping limit rate
Limits the rate of DHCP packets that can be received on a switch port. Ports exceeding the rate limit are err-disabled automatically, protecting against DHCP starvation attacks and rogue DHCP servers.
show vlan brief
Displays a summary of all VLANs in the switch database including VLAN ID, name, status, and the access ports assigned to each VLAN.
switchport mode access
Statically configures a switch port as an access port, disabling all DTP negotiation so the port permanently carries traffic for a single VLAN and can never negotiate to trunk mode.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions