Interface ConfigDomain 5.0

spanning-tree bpduguard

A critical security feature designed to protect PortFast-enabled edge ports. If an interface configured with BPDUGuard receives a Bridge Protocol Data Unit (BPDU) from a rogue switch, it immediately shuts down the port to prevent a bridging loop.

Quick Reference

Execution ModeSwitch(config-if)#

Trigger ConditionReceipt of any BPDU frame.

Resulting Interface Stateerr-disabled

Negation Commandno spanning-tree bpduguard enable

Syntax & Scope Mechanics

spanning-tree bpduguard [enable | disable]

BPDUGuard is almost exclusively used in tandem with PortFast. Because PortFast skips the 30-second listening/learning phases, a user plugging a rogue switch into the wall could crash the network instantly. BPDUGuard solves this by assuming that any device sending a BPDU (which only switches do) is a threat.

Interface Mode (enable): Hardcodes BPDUGuard on a specific port, regardless of whether PortFast is running or not. spanning-tree bpduguard enable
Global Mode (default): The enterprise best practice. When applied globally, it automatically enables BPDUGuard on every interface that has PortFast enabled. spanning-tree portfast bpduguard default

CLI Deployment Scenarios

Scenario 1: Securing an Open Lobby Port

You are configuring a wall jack in a public waiting room. You enable PortFast so visitor laptops can boot quickly, but secure it with BPDUGuard in case someone plugs in an unmanaged switch.

Switch(config)# interface FastEthernet0/10

Switch(config-if)# spanning-tree portfast

Switch(config-if)# spanning-tree bpduguard enable

Scenario 2: The Rogue Switch Penalty

A malicious user plugs a 5-port switch into FastEthernet0/10. The 5-port switch sends a BPDU packet into your network. The Cisco switch immediately kills the port.

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet0/10 with BPDU Guard enabled. Disabling port.

%PM-4-ERR_DISABLE: bpduguard error detected on Fa0/10, putting Fa0/10 in err-disable state

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed state to down

CCNA Exam Gotchas

[!]

BPDUGuard vs. BPDUFilter

Cisco loves to test the difference between these two.
• BPDUGuard: Kills the port (err-disable) if a BPDU is received. It is a strict security mechanism.
• BPDUFilter: Simply ignores the BPDU and drops it silently. It does not shut down the port. Using BPDUFilter is considered dangerous because it removes Spanning Tree loop protection entirely without shutting down the physical vector.

[!]

Recovering an Err-Disabled Port

Once a port is in an err-disabled state due to BPDUGuard, it will not come back online automatically (unless the errdisable recovery global timer is configured). As an admin, you must manually go to the interface, execute shutdown, and then execute no shutdown to bounce the port back to life.