BPDU Guard and BPDU Filter

BPDU Guard and BPDU Filter are Cisco enhancements to Spanning Tree Protocol (STP) used on ports configured with PortFast. PortFast is a feature that immediately transitions a port from blocking to forwarding state, bypassing the usual listening and learning states. This is typically applied to access ports connecting end hosts (PCs, printers, servers) to avoid delays during boot-up.

However, PortFast creates a risk: if a switch or bridge is accidentally connected to a PortFast-enabled port, STP loops can form because the port didn't go through the normal BPDU exchange process. BPDU Guard and BPDU Filter mitigate this risk in different ways.

BPDU Guard Operation: 1. A switch port is configured with PortFast and BPDU Guard. 2. The port comes up and immediately enters forwarding state (due to PortFast). 3. If a BPDU frame arrives on that port (destination MAC 01:80:C2:00:00:00, with STP information), the switch CPU processes it. 4. The switch detects that BPDU Guard is enabled on the receiving port. 5. The switch immediately places the port into errdisable state. The port LED turns orange/amber. 6. The switch logs a message: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port GigabitEthernet0/1 with BPDU Guard enabled. Disabling port. 7. The port stops forwarding all traffic. The connected device loses connectivity. 8. Recovery requires manual shutdown / no shutdown or errdisable recovery automation.

BPDU Filter Operation: 1. A switch port is configured with PortFast and BPDU Filter. 2. When the port comes up, BPDU Filter prevents the switch from sending any BPDUs out that port. 3. If a BPDU arrives on that port, the switch drops it; the BPDU is not processed by STP. 4. The port remains in forwarding state (due to PortFast). 5. The connected device (even a rogue switch) does not receive any BPDUs, so it may assume it is the root bridge (if it runs STP) or cause a loop if the rogue switch connects to another part of the network. 6. No errdisable occurs; the port stays up.

To verify BPDU Guard and BPDU Filter configuration and status:

Show running-config for interface:

interface GigabitEthernet0/1
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable

Show spanning-tree interface detail:

Switch# show spanning-tree interface gigabitEthernet 0/1 detail
 Port 1 (GigabitEthernet0/1) of VLAN0001 is forwarding
   Port path cost 4, Port priority 128, Port Identifier 128.1.
   Designated root has priority 32768, address aabb.cc00.0100
   Designated bridge has priority 32768, address aabb.cc00.0100
   Designated port id is 128.1, designated path cost 0
   Timers: message age 0, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   BPDU: sent 0, received 0
   The port is in the portfast mode
   BPDU guard is enabled
   BPDU filter is disabled

Show errdisable recovery:

Switch# show errdisable recovery
ErrDisable Reason    Timer Status
-----------------    --------------
bpduguard            Enabled

Timer interval: 300 seconds

Show interfaces status (to see errdisable):

Switch# show interfaces status
Port      Name   Status       Vlan    Duplex Speed Type
Gi0/1            err-disabled 1       auto   auto  10/100/1000BaseTX

BPDU Guard and BPDU Filter are specifically tied to PortFast. They are not standalone features; they must be used in conjunction with PortFast to be effective. They are part of the broader STP toolkit that includes: - Root Guard: Prevents a port from becoming a root port; if a superior BPDU is received, the port goes into root-inconsistent state. - Loop Guard: Prevents alternate/root ports from becoming designated in the absence of BPDUs; if no BPDUs are received, the port goes into loop-inconsistent state. - UDLD (Unidirectional Link Detection): Detects unidirectional links and places ports in errdisable.

On the exam, know that BPDU Guard is the most common security feature for access ports, while BPDU Filter is rarely used because it offers no protection. BPDU Filter is sometimes used in specific scenarios, such as when connecting to a non-STP device that may send BPDUs (e.g., some IP phones) or to reduce BPDU traffic on ports that don't need it.

In enterprise networks, BPDU Guard is a standard security measure on all access ports. Imagine a corporate campus with thousands of desks. Each desk has a wall jack connected to a switch port configured with PortFast (to speed up PC boot time) and BPDU Guard (to prevent accidental loops if someone plugs in a switch). This is a best practice recommended by Cisco. Network engineers deploy this globally using spanning-tree portfast default and spanning-tree portfast bpduguard default on all access switches. This ensures that even if a junior technician or a malicious user plugs in a rogue switch, the port will automatically disable, triggering an alert via syslog or SNMP.

A common real-world scenario is during office moves or expansions. An employee might unplug their PC and plug in a small switch to share the connection with a colleague. Without BPDU Guard, this could create a loop if the switch also connects to another network point. With BPDU Guard, the port disables, causing a temporary outage but preventing a network-wide broadcast storm. The help desk then receives a ticket, investigates, and re-enables the port after removing the rogue switch.

BPDU Filter is rarely used in production due to its lack of protection. However, it has niche uses. For example, some older IP phones or devices might emit BPDUs due to a bug or misconfiguration. If you cannot replace the device, you might enable BPDU Filter on that specific port to prevent the BPDUs from being processed, while still allowing the device to function. Another scenario is when connecting to a non-STP device that you trust, such as a router interface that does not run STP. In that case, BPDU Filter reduces unnecessary BPDU traffic. But generally, BPDU Guard is the safer choice.

Scale considerations: In large networks with thousands of ports, enabling errdisable recovery is crucial to avoid manual intervention for every false positive. However, recovery should have a reasonable timer (e.g., 300 seconds) to allow an administrator time to investigate. Also, BPDU Guard can be combined with other features like Storm Control and Port Security for comprehensive access layer protection.

Misconfiguration: A common mistake is enabling BPDU Guard on trunk ports or uplinks. This would cause the port to err-disable if any BPDU is received from the neighboring switch, effectively breaking the link. Therefore, BPDU Guard should only be applied to access ports where end hosts are expected. Similarly, enabling BPDU Filter on a port that connects to another switch can cause STP loops because the port will ignore BPDUs and stay forwarding, potentially creating a bridging loop.