Spanning-tree // portfast // bpdufilter // bpduguard

[martcorrea]

Buenas tardes.

Estoy configurando spanning tree en equipos de acceso, en el vtp tengo dos de distribución (WS-C4506-E) y dos Core (WS-C6506-E) en modo cliente y en servidor, ¿Que mas puedo configurar en los puertos para evitar que los usuarios tiren la red por duplicación de mac address?

320rpvDFswa3750-04#sh run int g1/0/1
Building configuration...

Current configuration : 534 bytes
!
interface GigabitEthernet1/0/1
switchport access vlan 100
switchport mode access
switchport nonegotiate
switchport voice vlan 200
switchport port-security maximum 3
switchport port-security
switchport port-security aging time 20
speed 100
duplex full
mls qos trust device cisco-phone
mls qos trust cos
storm-control broadcast level 10.00
storm-control multicast level 10.00
storm-control action trap
spanning-tree portfast
spanning-tree bpdufilter enable
spanning-tree bpduguard enable

Saludos,

[paul driver]

Hello

spanning-tree portfast 
spanning-tree bpdufilter enable
spanning-tree bpduguard enable

I labbed this up some time back and these are the results:

Portfast:
when enabled, skips listening and learning state,
when interface is brought up, regardless of being configured in interface mode,
or from global config -

Enabled From global config if bpgdu are seen only in this mode then portfast status is lost.
Enabled From port config port stills continues to be in portfast regarless


BPDU Guard:
BPDUs, when seen on portfast enabled ports, shuts down (err-disables) the port.   
May be applied from global or interface config.   

If applied in interface config, portfast doesn't need to be enabled,
and if BPDUs show up, it will still put the port in err-disable.
 


BPDU Filter:
Stops BPDUs from being sent or received on ports that are operationally using portfast.

If configured from global config,
BPDUs will trigger the port to stop using portfast( normal STP State) and BPDU filtering will stop on that port.   

If applied in interface config,
BPDUs will be filtered, regardless of portfast operational state protential

Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops.


res
Paul