Spanning Tree

[sgalarza]

Hello,

Kind of a basic question but, I have bpdu guard enabled on all of my access ports connecting to hosts, I was wondering what bpdu "filter" should I be using on trunk ports connecting to other switches and the router.  

[Reza Sharifi]

Hi,

Have a look at this post.

https://supportforums.cisco.com/document/45136/importance-bpdu-guard-and-bpdu-filter

HTH

[sgalarza]

So should I be using bpdu filter on trunk ports or root guard?  The link you posted was informational but slightly contradicting.  One person saying:  

"BPDU filter only stops sending BPDUs on that interface, the port is able to receive them, now, if the port is configured in spanning tree port fast mode, it will stops sending BPDUs as well," 

Any help would be great.

Thanks,

[Jon Marshall]

The answer is no, you should not run it on any ports that interconnect switches because switches need to see all BPDUs.

Jon

[sgalarza]

Jon,

Thanks for the reply, I realize interconnecting switches need to see bpdu's, what I'm asking is should I be using any other type of spanning tree filter such as root guard for my trunk ports.

Thanks

[Jon Marshall]

You can do if you think there is a chance a new switch could become root.

It is a useful protection especially if not all switches are under your control but even if they are you may want to enable it.

It is up to you really.

Jon

[sgalarza]

Jon, 

Much appreciated response, this clears things up for me.  I do have control over all the switches in our organization, and we have our root bridge set so I don't foresee any issues with superior bpdu's messing up our root.  

Thanks again,

Steve

[Jon Marshall]

No problem, glad to have helped.

Jon

[Reza Sharifi]

Only access ports

BPDU guard can be enabled globally for all access ports.

The BPDU guard feature can be globally enabled on the switch or can be enabled per port, but the feature operates with some differences.

At the global level, you enable BPDU guard on Port Fast-enabled ports by using the spanning-tree portfast bpduguard default global configuration command. Spanning tree shuts down ports that are in a Port Fast-operational state if any BPDU is received on them. In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port means an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the port in the error-disabled state. When this happens, the switch shuts down the entire port on which the violation occurred.

Here is a link to the config guide on how to enable it.

I also recommend testing it if you a couple extra devices in the lab.

HTH

[sgalarza]

Reza,

I appreciate all the insight thanks for your time.