Configuration spanning-tree on root

[mulbreizh]

Hello and sorry for my english , 

My core switch is also root of spanning-tree, i use Rapid-pvst.  On this switch, in global configuration i can see :

spanning-tree portfast bpduguard default
spanning-tree portfast bpdufilter default

This commands are necessary ? not ?

thanks a lot

[MHM Cisco World]

MHM

[MHM Cisco World]

Two solution for portfast+bpduguard+bpdufilter

Solution1 

Global 

spanning-tree portfast bpduguard default
spanning-tree portfast bpdufilter default

Interface

Spanning-tree portfast 

Solution2

Interface 

Spanning-tree portfast 

Spanning-tree bpduguard enable 

Spanning-tree bpdufilter enable 

You use first solution for simplicity, and it work but be aware which port you config as portfast that all

MHM

[Joseph W. Doherty]

"This commands are necessary ?"

No.

But are they a good practice to use?

Usually, yes.

[paul driver]

Hello
Id would recommend to remove bpdufilter globally especially 

Both of those commands enabled globally work in conjunction with port-fast enabled edge ports -  and as you SHOULD append port-fast to ALL access-edge ports I would recommend disabling both commands globally and applying bpdu-guard at interface level where it will work with/without portfast

[mulbreizh]

If there are apply globally but not in interfaces, i can let like this in global configuration ?

[paul driver · Accepted solution]

Hello
You can leave it however as stated , I would say its not preferable to do so, especially bpdu-filter.
disabling it globally and applying it at an interface level is more deterministic and you have better control as when those features will initiate.

[Giuseppe Larosa]

Hello @mulbreizh ,

bpdu guard = good

bpdu filter = bad idea .

BPDU filter should be used only on specific corner cases like connecting to other network where you don't want to joint your Rapid PVST domain with some other devices.

on normal user ports BPDU filter should not be used.

So my personal suggestion is to remove the command

conf it

no spanning-tree portfast bpdufilter default

( note to disable the command may be different )

Finally if your core switch is acting as a pure core switch i.e. it just has inter switch links with distribution layer switches or access layer switches both commands are useless, however you can keep the one for  bpdu guard .

Final note : stay also away from

spanning-tree loopguard default

it can create issues. I had a customer many years ago that had incident caused by this.

Hope to help

Giuseppe

[mulbreizh]

Most of my network is cisco switch with VTP domain. I just have 4 Aruba switchs on other spanning-tree but connect to the core /

with configuration like this on aruba :
interface lag 1 multi-chassis
description LACP-to-Coeur
no shutdown
no routing
vlan trunk native 999
vlan trunk allowed 1-2,5,15,17,21-22,25-26,45,51,54,56,61-62,70,89,100,102,104,110,999
lacp mode active
spanning-tree bpdu-filter
spanning-tree rpvst-filter

[MHM Cisco World]

Bad idea why ? if he careful config it ?
if he have more than 48 ports instead of add two or three command under the port connect to host he only need specify this port is portfast and make global config add it auto

both solution I share misconfig the bpdufilter is make issue 

MHM

[MHM Cisco World]

@mulbreizh o

bpdufilter 

Cisco Sw use bpdufilter in link connect to other SW vendor to disable STP between two SW 

This can Done only if there is only one link connect two SW 

Why ? Because Cisco SW not use standard IEEE stp it use it stp abd that not compatible with other vendor that why disable stp by bpdufilter is one solution 

Other is run MST

MHM

[paul driver]

Hello

---

@mulbreizh wrote:

Most of my network is cisco switch with VTP domain. I just have 4 Aruba switchs on other spanning-tree but connect to the core /

interface lag 1 multi-chassis
description LACP-to-Coeur
no shutdown
no routing
vlan trunk native 999
vlan trunk allowed 1-2,5,15,17,21-22,25-26,45,51,54,56,61-62,70,89,100,102,104,110,999
lacp mode active
spanning-tree bpdu-filter
spanning-tree rpvst-filter

---

By default arubas usually run mstp and not rstp, it seems the port cfg you hasve shared is the aruba interface (mLAG) 

It looks like you are filtering bpdus on this lag for a reason, maybe its the interconnect between the cisco, if that is the case I would leave it be.

FYI when Ive have had to interconnect two STP domains in the past , especially between cisco and aruba, the arubas have a neat feature called rpvst-mstp-interconnect-vlan x  which allows you specify the vlan (other than vlan 1) you which to interconnect between the two stp domains and on the cisco pvst simulation seems to work also.

[mulbreizh]

Yes, and i have trouble between the cisco and aruba like you can this my post here : https://community.cisco.com/t5/switching/trunk-between-cisco-an-aruba/td-p/5168104