Spanning-Tree BPDUFilter

[mironduplessis]

Hi,

Is it recommended to use the Spanning-tree BPDUFilter command on an access port interface or not.

Regards

Miron

[Jon Marshall]

Hi Miron

If you are enabling portfast on your access ports then yes it is recommened that you should enable BPDUFilter as well as BPDUGuard.

HTH

[sundar.palaniappan]

Miron,

I assume you mean bpduguard. There's a difference between bpduguard and bpdufilter. When bpduguard is enabled on a port the switch will put the port in err-disable state if it receives a bpdu on the port. Whereas, bpdufilter will stop the port from sending/receiving bpdu and that's like disabling STP on the port. Typically, bpduguard is recommended for access ports.

HTH

Sundar

[mironduplessis]

Hi,

I understand the advantages behind using the filter command but in the event that a device is added to the port like a hub which has the capability of introducing a loop into the network, the addition of the filter command would cause more problems than it solves?

Miron

[Jon Marshall]

Hi Miron

Yes, you have to be careful. Excerpt from cisco doc:-

==========================================

Enabling BPDU Filtering

When you globally enable BPDU filtering on Port Fast-enabled interfaces, it prevents interfaces that are in a Port Fast-operational state from sending or receiving BPDUs. The interfaces still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. You should globally enable BPDU filtering on a switch so that hosts connected to these interfaces do not receive BPDUs. If a BPDU is received on a Port Fast-enabled interface, the interface loses its Port Fast-operational status, and BPDU filtering is disabled.

You can also use the spanning-tree bpdufilter enable interface configuration command to enable BPDU filtering on any interface without also enabling the Port Fast feature. This command prevents the interface from sending or receiving BPDUs.

--------------------------------------------------------------------------------

Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops.

You can enable the BPDU filtering feature if your switch is running PVST+, rapid PVST+, or MSTP.

============================================

So if you have portfast turned on and the switchport receives a BPDU the port disables portfast and bpdu filtering. if it disables portfast then it will now have to go through the spanning tree calculation as far as i understand it.

Where it can be dangerous is if you enable it on a port not running port fast. This in effect turns off spanning tree on that port.

So i would only use it on port fast enabled ports.

HTH