Dear friends,
Please allow me to join.
I agree with Joseph - preventing a newly added switch from participating in STP is not advisable, because the loop protection in switched networks depends on all switches running STP and cooperating in creating a single, contiguous loop-free topology. If one or more switches do not participate in STP, protection against switching loops is only partial.
Deactivating STP on a switch can cause it either to drop all received BPDUs, or to flood them transparently. The first option is actually worse because dropping BPDUs means that STP will be unable to detect a loop even if there is one. The second option is slightly better, as STP will treat such a switch simply as a shared network segment (a "cable" if you will), and will at least be able to block ports on the "end of that cable". The inside of that "cable" won't be protected against loops, though.
If the newly added switch is fully under your control then it would be a bad practice to prevent it from participating in your STP, and I cannot recommend it. If you are concerned that adding the switch will cause a temporary network outage then it would perhaps be advisable to schedule a maintenance window for that (the outage, should it happen, should be under 50 seconds; with RSTP and MSTP, under 1 second, and in general, adding a new non-root switch will not cause any outage at all). Certainly, this inconvenience is much better than dealing with a switching loop that got caused just because you have prevented the switch from participating in your STP.
If the switch is not under your administration then I suggest using the Root Guard to prevent that switch from becoming a root switch but still allow it to participate in your STP as long as it behaves well. A Root Guard is activated on a per-port basis and prevents that port from becoming a root port (and consequently, prevents the attached switch from becoming a root switch):
interface FastEthernet0/1
spanning-tree guard root
If you absolutely insist on preventing that switch from interacting with your STP, then you can use the BPDU Filter feature that prevents a port from sending and receiving BPDUs, effectively creating a boundary in the STP domain. This practice comes at your own risk - with the BPDU Filter in place, it is your responsibility to make sure that there are no physical loops in the network behind the boundary or through it, because STP will no longer be able to detect and eliminate them.
interface FastEthernet0/1
spanning-tree bpdufilter enable
Best regards,
Peter
