PortFast on a Trunk Port

[Steve Harvey]

Dear all, 

refer to the configuration given below, can anyone guide me that "spanning-tree portFast" will cause switching loops or not ? 
 

interface GigabitEthernet1/0/48
 description "UPLINK-TO-MEMBERSHIP-03-SW-02"
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 103
 switchport mode trunk
 switchport nonegotiate
 channel-group 16 mode on
 spanning-tree portfast

---------------------------------

The switch is using Pvst (config given below)

spanning-tree mode pvst
spanning-tree etherchannel guard misconfig
spanning-tree extend system-id
spanning-tree vlan 103 priority 24576

Kindly help.

[Jon Marshall · Accepted solution]

Steve

It's not so much as to whether it will create a loop as if there is a loop in your topology ie. redundant links etc. then it could create problems.

The issue is porftast does still run STP but it allows the port to begin forwarding immediately. If these are switch interconnects you don't want that to happen. You need to the switches to block on those ports and work out a loop free topology before any data is forwarded.

Where you use portfast is -

1) on ports connected to end device such PCs, servers etc where the port is only in one vlan using the "spanning-tree portast" command

2) if the port is configured as a trunk link and connected to an end device such as a server then you can use the "spanning-tree portfast trunk" command.

So you can use portfast on a trunk link using the second command above but on switch interconnects you should not use either version of the portfast command.

Jon

[Leo Laohoo · Accepted solution]

 spanning-tree portfast

If I am not mistaken, this "kind" of portfast will only work on an access port.  For a trunk port, there's another sub-command.  

However, I agree with Jon.  Unless you've got a death wish or something, you'd want to disable portfast on trunk ports.  Only allow portfast on access ports.

To prevent someone from plugging a switch into an access port and potentially causing a storm, make sure your access port has "spanning-tree bpduguard enable".