How BPDU Filtering provides security?

[veddotcom]

1.I know,the port on which BPDU Filtering operates, it disables the incoming and outgoing of BPDU which prevents looping and hence provides security.

2.However it also states if any of the portfast port (on which BPDU Filtering is already operating) receives a BPDU, the BPDU filter will take that port out of the portfast state and force that port to be part of STP topology again.

My question is,

First of all when the BPDU filtering is enabled, in which case the port will encounter the BPDU for which the second statement is...

[I am assuming somehow port will reveice the BPDU even after enabling BPDU Filter]

if a new switch is plugged into the portfast port on which BPDU filter is enabled, the new switch will send BPDUs, and then according to the rule, the portfast port will now allow BPDU transmission in both direction, resulting new switch could be root switch. isn't it?

Kindly clear my confusion guys, where i am wrong?

Thanks & Regards

[Matthew Blanshard]

To accomplish what you desire you will need to use the spanning-tree portfast bpdufilter default command.  There are two distinct behaviors of bpdufilter explained below:

1)  "Spanning-tree bpdufilter enable" on the interface.  This disables the sending and receiving of BPDU's on the port.  All BPDU's incoming on the port are discarded.  This effectivly removes the port from ever participating in spanning tree.

2)  "Spanning-tree portfast bpdufilter default" in global configuration.  What this configuration will do is any port which is in portfast mode will not send out BPDU's but will receive BPDU's and when it does will revert the port back to a normal spanning-tree port, and lose it's portfast state. 

So in this instance you will need to use option #2 to solve this problem. 

HTH,

-Matt

[veddotcom]

Thanks Matt for your valuable reply and making BPDU filter more clear, however i m still confused with the security part of the BPDU,

I mean whats the point of re-enabling the portfast port for STP again, doesn't it sound security vulnerable..For Example which i given above..

if a new switch is plugged into the portfast port on which BPDU filter is enabled, the new switch will send BPDUs, and then according to the rule, the portfast port will now allow BPDU transmission in both direction, resulting new switch could be root switch. isn't it?

[Aileron88]

That is correct. When the portfast port that has been enabled with bpdufilter recieves the BPDU it will revert out of the portfast state and move through the standard spanning-tree states. The new switch can be the root, but you can use the spanning-tree root guard feature to prevent this from happening. From a security point of view they make sure that if a switch is plugged in that is in taking part in the spanning-tree topology. I wouldn't want anyone plugging switches in that shouldn't be there, so I would use the bpduguard feature myself.