Skip to content
Log in Sign up My account

3.1.c Spanning Tree Protection: PortFast, BPDU Guard, BPDU Filter, Root Guard, Loop Guard

Blueprint 3.1.c: Configure and verify common Spanning Tree Protocols (RSTP, MST) and Spanning Tree enhancements such as root guard and BPDU guard

This page covers the enhancements:

  • PortFast (edge ports) on access and trunk ports
  • BPDU Guard and err-disable recovery
  • BPDU Filter, global vs interface behaviour, and why it is dangerous
  • Root Guard and the root-inconsistent state
  • Loop Guard and the loop-inconsistent state
  • Where each feature belongs in a campus design

These features apply equally to Rapid PVST+ (RSTP page) and MST (MST page).

Why spanning tree needs help

Spanning tree trusts every BPDU it receives. That causes three classic failures:

  1. Slow or noisy host ports. A host port without PortFast waits through discarding and learning when the link comes up (when RSTP cannot do proposal/agreement with a host) and generates a topology change every time it goes forwarding.
  2. Unauthorised switches. A user plugs in a switch with priority 0, which becomes root and drags the whole VLAN's traffic through a desk.
  3. Lost BPDUs. A unidirectional fibre or a software fault stops BPDUs arriving on a blocking port. The port decides the path is gone, becomes designated and forwards, and a loop forms.

Each enhancement below fixes one of these.

graph TB
  D1["DIST1 root"] === D2["DIST2 secondary root"]
  D1 -- "Root Guard on DIST downlinks" --- A1["ACC1"]
  D2 -- "Root Guard on DIST downlinks" --- A1
  A1 -- "PortFast + BPDU Guard" --- H1["Host"]
  A1 -- "PortFast trunk + BPDU Guard" --- V["Hypervisor"]
  A1 -. "Loop Guard on ACC1 uplinks<br/>(root and alternate ports)" .- D1
Feature Placed on Protects against Action when triggered Recovery
PortFast Ports to hosts, servers, phones Slow startup, needless topology changes Port loses edge status if a BPDU arrives Automatic
BPDU Guard PortFast (edge) ports Any switch plugged into an edge port Err-disable Manual or errdisable recovery
BPDU Filter Rare: edges where BPDUs must not be exchanged BPDU exchange Global: stop sending; interface: stop sending and ignore n/a
Root Guard Designated ports facing downstream switches A downstream switch becoming root Root-inconsistent (blocking) per VLAN or instance Automatic when superior BPDUs stop
Loop Guard Root and alternate ports (non-designated) Loops from lost BPDUs Loop-inconsistent (blocking) per VLAN or instance Automatic when BPDUs return

PortFast

PortFast makes a port an edge port. It moves straight to forwarding when the link comes up and never generates a topology change. If an edge port receives a BPDU, it immediately loses edge status and behaves like any other spanning tree port, so PortFast alone does not create a loop. It does, however, let a rogue switch participate in spanning tree.

The syntax differs between releases. Use ? in the simulator if one form is rejected.

spanning-tree portfast default              ! all access ports become edge ports
!
interface GigabitEthernet1/0/10
 spanning-tree portfast                     ! one access port
interface GigabitEthernet1/0/20
 spanning-tree portfast trunk               ! trunk to a server or hypervisor
interface GigabitEthernet1/0/48
 spanning-tree portfast disable             ! exclude a port from the global default

spanning-tree portfast edge default
!
interface GigabitEthernet1/0
 spanning-tree portfast edge
interface GigabitEthernet1/1
 spanning-tree portfast edge trunk
interface GigabitEthernet0/1
 spanning-tree portfast disable

Points to know:

  • The global default applies only to ports in access mode. Trunks need portfast trunk (or portfast edge trunk) on the interface.
  • IOS warns when you enable PortFast that it should only be used on ports connected to a single host. Take the warning seriously.
  • PortFast is not related to the speed of DTP or EtherChannel negotiation. Those still take their own time.

BPDU Guard

BPDU Guard err-disables a port the moment it receives any BPDU. It is the standard companion to PortFast on every user-facing port.

spanning-tree portfast bpduguard default        ! every operational PortFast port
                                                ! (15.2 form: spanning-tree portfast edge bpduguard default)
!
interface GigabitEthernet1/0/10
 spanning-tree bpduguard enable                 ! this port, with or without PortFast
Form Applies to
Global ... bpduguard default Only ports that are operationally PortFast
Interface spanning-tree bpduguard enable That port, regardless of PortFast

When it fires:

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi1/0 with BPDU Guard enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0, putting Gi1/0 in err-disable state

ACC1# show interfaces status err-disabled

Port      Name               Status       Reason               Err-disabled Vlans
Gi1/0                        err-disabled bpduguard

The port stays down until someone bounces it (shutdown, no shutdown) or err-disable recovery is configured:

errdisable recovery cause bpduguard
errdisable recovery interval 300               ! seconds; 300 is the default

show errdisable recovery lists which causes have recovery enabled, the interval, and which interfaces are waiting with the time left.

Exam trap

The global bpduguard default command does nothing on a port that is not operationally PortFast. If a question shows the global command but the interface has no PortFast (and no global PortFast default), a BPDU on that port is processed normally and the port is not err-disabled. The interface-level bpduguard enable does not depend on PortFast.

BPDU Filter

BPDU Filter stops a port from sending BPDUs. Its behaviour depends heavily on where you configure it.

Form Sends BPDUs Receives BPDUs Effect
Global spanning-tree portfast bpdufilter default No, on operational PortFast ports (after a short burst at link up) If one arrives, the port loses PortFast and filtering and runs normal STP Reasonably safe: reduces BPDU noise on host ports
Interface spanning-tree bpdufilter enable No Ignored Spanning tree is effectively disabled on the port. A loop through it will not be detected. 
spanning-tree portfast bpdufilter default       ! global form
!
interface GigabitEthernet0/3
 spanning-tree bpdufilter enable                ! interface form: use with great care

If BPDU Guard and BPDU Filter are both configured on the same interface, BPDU Filter takes precedence and BPDU Guard never fires, because the filtered BPDUs are never processed.

Exam trap

Interface-level BPDU Filter is not "a gentler BPDU Guard". It turns spanning tree off on that port. If a user connects both ends of a cable to two filtered ports, or a downstream switch creates a redundant path, the result is a bridging loop. When an answer choice proposes interface BPDU Filter to stop a rogue switch, it is almost always wrong; BPDU Guard is the right tool.

Root Guard

Root Guard enforces where the root bridge is allowed to be. Configure it on designated ports that face switches which should never become root, typically distribution downlinks toward access switches, or ports facing another administrative domain.

interface GigabitEthernet0/2
 description Downlink to ACC1
 spanning-tree guard root

If a port with Root Guard receives a superior BPDU (one that would make the sender the root, or give a better path to the root through that port), the switch puts the port into the root-inconsistent state for that VLAN or instance. The port does not forward in that VLAN. Other VLANs on the trunk are unaffected. The port is not err-disabled: once the superior BPDUs stop (for example after the rogue switch's priority is fixed), the port recovers automatically after the BPDU information ages out.

%SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port GigabitEthernet0/2 on VLAN0010.

DIST1# show spanning-tree inconsistentports

Name                 Interface              Inconsistency
-------------------- ---------------------- ------------------
VLAN0010             GigabitEthernet0/2     Root Inconsistent

Number of inconsistent ports (segments) in the system : 1

DIST1# show spanning-tree vlan 10 | include Gi0/2
Gi0/2               Desg BKN*4         128.3    P2p *ROOT_Inc

BKN* means broken, and the suffix tells you which guard blocked it.

Exam trap

Root Guard on a root port is a design mistake. The root port is supposed to receive superior BPDUs, so Root Guard blocks the switch's own path to the root. Place Root Guard on the ports that point away from the root (designated ports), never on uplinks toward it.

Loop Guard

Loop Guard protects non-designated ports (root and alternate) from becoming designated just because BPDUs stopped arriving. Without it, a blocking alternate port that stops hearing BPDUs (for example because one fibre of a pair failed, so traffic still flows in the other direction) ages out the information, becomes designated, starts forwarding, and creates a loop.

spanning-tree loopguard default                 ! all point-to-point ports
!
interface GigabitEthernet0/2
 spanning-tree guard loop                       ! one port

With Loop Guard, a root or alternate port that stops receiving BPDUs moves to loop-inconsistent (blocking) for that VLAN or instance instead of becoming designated. When BPDUs arrive again, it recovers by itself.

%SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/2 on VLAN0010.

ACC1# show spanning-tree inconsistentports

Name                 Interface              Inconsistency
-------------------- ---------------------- ------------------
VLAN0010             GigabitEthernet0/2     Loop Inconsistent
Root Guard Loop Guard
Trigger Superior BPDU received BPDUs stop arriving
Port roles it protects Designated Root and alternate
Typical place Distribution downlinks Access uplinks, inter-switch links, or globally
State Root inconsistent Loop inconsistent
Recovery Automatic Automatic
Same port? Mutually exclusive: spanning-tree guard takes one keyword

Loop Guard has no effect on edge ports and is not meant for shared links. UDLD (Unidirectional Link Detection) solves a similar problem at Layer 2 by checking that the neighbour sees you on the link, and err-disables the port in aggressive mode. The two are complementary: UDLD catches miswired or one-way fibre, Loop Guard catches any reason BPDUs stop.

Checking what is enabled

ACC1# show spanning-tree summary
Switch is in rapid-pvst mode
Root bridge for: none
Extended system ID                      is enabled
Portfast Default                        is enabled
PortFast BPDU Guard Default             is enabled
Portfast BPDU Filter Default            is disabled
Loopguard Default                       is enabled
EtherChannel misconfig guard            is enabled
Configured Pathcost method used is short
UplinkFast                              is disabled
BackboneFast                            is disabled

The exact wording of these lines varies between releases (15.2 images say "Portfast Edge BPDU Guard Default", for example), but the same information is there.

ACC1# show spanning-tree interface GigabitEthernet1/0 detail
 Port 5 (GigabitEthernet1/0) of VLAN0010 is designated forwarding
   Port path cost 4, Port priority 128, Port Identifier 128.5.
   ...
   The port is in the portfast mode
   Link type is point-to-point by default
   Bpdu guard is enabled
   BPDU: sent 312, received 0
Command Use
show spanning-tree summary Global defaults for PortFast, BPDU Guard, BPDU Filter, Loop Guard, misconfig guard
show spanning-tree interface X detail Per-port PortFast, guard and filter state, BPDU counters
show spanning-tree inconsistentports Every port blocked by Root Guard, Loop Guard, PVID or type inconsistency
show interfaces status err-disabled Ports shut by BPDU Guard and other err-disable causes
show errdisable recovery Which causes recover automatically and the timers

Lab: put each guard to work

Topology: the module base block running Rapid PVST+ (RSTP lab), plus one extra IOSvL2 called ROGUE connected to ACC1 Gi1/1.

graph TB
  D1["DIST1<br/>root VLAN 10"] -- "Po1" --- D2["DIST2<br/>root VLAN 20"]
  D1 -- "Gi0/2 to Gi0/1" --- A1["ACC1"]
  D2 -- "Gi0/2 to Gi0/2" --- A1
  A1 -- "Gi1/0" --- H1["Host1"]
  A1 -- "Gi1/1" --- R["ROGUE<br/>priority 0"]

Steps

  1. On ACC1 enable PortFast and BPDU Guard as global defaults. Make Gi1/1 an access port in VLAN 10. Cable ROGUE's Gi0/0 to it and set spanning-tree vlan 1-4094 priority 0 on ROGUE. Confirm ACC1 Gi1/1 is err-disabled for bpduguard.
  2. Configure errdisable recovery cause bpduguard and errdisable recovery interval 30 on ACC1. Watch Gi1/1 come back, receive a BPDU and go down again every 30 seconds. Disconnect ROGUE and confirm the port stays up.
  3. On DIST1 Gi0/2 and DIST2 Gi0/2 configure spanning-tree guard root. On ACC1 set spanning-tree vlan 10 priority 0. Confirm both distribution downlinks become root inconsistent for VLAN 10 only, and VLAN 20 keeps forwarding. Remove the priority on ACC1 and watch the ports recover.
  4. On ACC1 configure spanning-tree loopguard default. Then simulate lost BPDUs by entering spanning-tree bpdufilter enable on DIST2 Gi0/2. Confirm that ACC1 Gi0/2 goes loop inconsistent instead of forwarding. Remove the filter from DIST2.

Do step 4 in the order given

If you add the BPDU Filter on DIST2 before Loop Guard is active on ACC1, ACC1 Gi0/2 becomes designated and forwarding while DIST2 Gi0/2 also forwards and ignores BPDUs. That is a real bridging loop and will saturate the lab. This is exactly the failure Loop Guard exists to stop.

Configuration

spanning-tree portfast default              ! or: spanning-tree portfast edge default
spanning-tree portfast bpduguard default    ! or: spanning-tree portfast edge bpduguard default
spanning-tree loopguard default
errdisable recovery cause bpduguard
errdisable recovery interval 30
!
interface GigabitEthernet1/1
 switchport mode access
 switchport access vlan 10

interface GigabitEthernet0/2
 description Downlink to ACC1
 spanning-tree guard root

Expected verification

Step 1:

ACC1# show interfaces status err-disabled

Port      Name               Status       Reason               Err-disabled Vlans
Gi1/1                        err-disabled bpduguard

Step 3:

DIST1# show spanning-tree inconsistentports

Name                 Interface              Inconsistency
-------------------- ---------------------- ------------------
VLAN0010             GigabitEthernet0/2     Root Inconsistent

Number of inconsistent ports (segments) in the system : 1

Step 4:

ACC1# show spanning-tree vlan 10 | include Gi0/2
Gi0/2               Altn BKN*4         128.3    P2p *LOOP_Inc

In VLAN 20, where ACC1 Gi0/2 is the root port, Loop Guard blocks it too, and ACC1 reconverges VLAN 20 onto Gi0/1. That is the safe outcome.

Related diagrams: E21 RSTP port roles. The ENCOR practice bank has more BPDU Guard questions.

Quick check

An access port has spanning-tree bpduguard enable and spanning-tree bpdufilter enable. A switch is connected and sends BPDUs. What happens?

Nothing visible: BPDU Filter takes precedence, the BPDUs are ignored and the port is not err-disabled. The port forwards with no spanning tree protection, which can create a loop.

Root Guard puts a trunk into root-inconsistent state for VLAN 30. What happens to VLANs 10 and 20 on that trunk?

They continue to forward normally. Root Guard acts per VLAN (or per MST instance), only where superior BPDUs are received.

Which guard should be on an access switch's alternate uplink port to protect against a unidirectional fibre failure?

Loop Guard (optionally with UDLD). It stops the alternate port from becoming designated and forwarding when BPDUs stop arriving.

References

  • Catalyst 9300 Series Layer 2 Configuration Guide, chapter "Configuring Optional Spanning-Tree Features" (search on cisco.com for your release)
  • Cisco tech notes "Spanning Tree PortFast BPDU Guard Enhancement", "Spanning Tree Protocol Root Guard Enhancement" and "Spanning-Tree Protocol Enhancements using Loop Guard and BPDU Skew Detection Features" (search on cisco.com)
  • Cisco Live On-Demand Library: search "spanning tree" and "campus design best practices"