Question on BPDU Filter

[minumathur]

Hi

As per document if you enable bpdu filter globally then switch port lose it port fast status and STP send and receivd BPDU on the port and it would with any other STP port on switch , if this is case why we are using BPDU filter in switch ? Can anyone explain ... thank you

Minu

[Matthew Blanshard · Accepted solution]

BPDUfilter globally means that the ports do not send BPDU's but if it receives one then it drops the portfast status and acts normally in STP.  If you configure

BPDUfilter on the port then it does not send BPDU's and drops all received BPDU's making it not participate in STP 100%.  That's the difference

between the two.

You would configure BPDUfilter default globally if you did not want to send BPDU's but wanted to enable STP if someone plugged in an STP enabled switch on the port.

-Matt

[maggot_144 · Accepted solution]

The BPDU guard feature places interfaces that receive BPDUs in an err-disabled state. The BPDU filtering feature prevents the switch interface from sending or processing incoming BPDUs. The way to enable bpdu filtering globally is by using the command

SW1(config)#spanning-tree portfast bpdufilter default

That will enable all portfast interfaces for bpdu filtering, if one of those interfaces receives a bpdu it will lose its portfast state and will start processing BPDUs. You could configure BPDU filter globally to avoid the switch from sending unnecessary BPDUs out on portfast interfaces and configure bpdu guard at the interface level on the interfaces where you do not expect a switch to be plugged into.