Spanning tree bpdu

[ROBERTO TACCON]

is it true that if I configure on a switch port the following commands:

spanning-tree bpdufilter enable

spanning-tree bpduguard enable

the bpduguard is ineffective ?

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/12_2_20/config/stp_enha.htm#wp1020395

"Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops."

Thanks in advance.

[cdusio]

no.

enabling bpdu guard in that specific case will result in the switch ignoring bpdu's it receives and not sending any as well.

Now, if you enable it globally, and then leave the port in the default state, it will send out 10 bpdu's then if noe are received, go into bpdu filtering state.

Again, any portfast port that receives BPDU's on it will lose portfast state and then bpdu filtering is disabled.

HTH

Chris

[Francois Tallet]

The answer is subtle because it depends on the order the code deals with the configuration. Right now, when receiving a BPDU, STP checks in order for:

-per-port bpdufilter configuration

-per-port bpduguard configuration

-global bpduguard configuration

That means that if bpdufilter is configured on a port, the BPDU will dropped before BPDU guard has a change to see it, ie, BPDU guard will not be triggered.

On the other hand, bpdufilter can be configured globally. In that case, incoming BPDUs are not filtered and BPDU guard will be triggered.

Regards,

Francois