Switch spanning-tree bpduguard enable

[taro75]

I am configuring 9200 & 9300 series switches. Do I need to define "spanning-tree bpduguard enable" on each access port or trunk ports? Is it a best practice?

[MHM Cisco World]

No you need to enable it in all port connect to host not SW'

This port access  or trunk.

If you enable it to port connect to SW the STP will blk interconnect between SW.

[Flavio Miranda]

Hi

 Enable it on ports you dont want to receive BPDU. For example, if you have a trunk port with your Service Provider but you dont need BPDU from their side coming to your network, that could be a good place.

 Only allow BPDU on ports you know you need it.

[taro75]

So essentially, we should enable this on access ports where end devices are connected. On switch uplinks it should not be set. Am I right?

[MHM Cisco World]

Correct 

[M02@rt37]

Hello @taro75,

It is recommended to enable BPDUGuard on access ports where end devices are expected to be connected. This helps ensure that only authorized devices, which do not send BPDUs, are connected to those ports.

On the other hand, enabling BPDUGuard on trunk ports is not necessary or recommended. Trunk ports are expected to carry multiple VLANs and can receive BPDUs as part of the normal STP operation. Enabling BPDUGuard on trunk ports could lead to unintended port shutdowns if BPDUs are received on those ports.

[taro75]

Thank You.

BPDUGuard should be enabled on access ports. What about spanning-tree guard root? Is it requried to be set on uplink/trunk ports?

[MHM Cisco World]

 

[Gopinath_Pigili]

• Suppose that a switch is connected by mistake to a port where PortFast is enabled
• Now there is a potential for a bridging loop to form. An even greater consequence is that the potential now exists for the newly connected device to advertise itself and become the new root bridge.
• The BPDU Guard feature was developed to further protect the integrity of switch ports that have PortFast enabled
• PortFast is recommended only on Hosts/PC's connected ports not on Uplinks or Trunk ports. Same way BPDU Guard also should be enabled on PC's connected ports...not on Uplinks or Switch connected (Trunk) ports....

By default, BPDU Guard is disabled on all switch ports. You can configure BPDU Guard as a global default, affecting all switch ports with a single command.

Switch(config)# [no] spanning-tree portfast bpduguard default

You can also enable or disable BPDU Guard on a per-port basis, using the following interface configuration command:

Switch(config-if)# [no] spanning-tree bpduguard enable

Best regards
******* If This Helps, Please Rate *******

[taro75 · Accepted solution]

very clear explanation on BPDUGuard, do you have similar explanation on spanning-tree guard root?

[Gopinath_Pigili · Accepted solution]

• Suppose that another switch is introduced into the network with a bridge priority that is more desirable (lower) than that of the current root bridge.
• The new switch then would become the root bridge, and the STP topology might reconverge to a new shape. This is entirely permissible by the STP because the switch with the lowest bridge ID always wins the root election. However, this is not always desirable for you...
• In that case you can use Root Guard feature to not allowing the new switch to become root brige.....
• If another switch advertises a superior BPDU, or one with a better bridge ID, on a port where Root Guard is enabled, the local switch will not allow the new switch to become the root. As long as the superior BPDUs are being received on the port, the port will be kept in the root-inconsistent STP state.
• You can enable Root Guard only on a per-port basis. By default, it is disabled on all switch ports.

To enable it, use the following interface configuration command:

Switch(config-if)# [no] spanning-tree guard root

You can display switch ports that Root Guard has put into the root-inconsistent state with the following command:

Switch# show spanning-tree inconsistentports

Best regards

******* If This Helps, Please Rate *******

[taro75]

Is it always a recommended practice to set BPDUGuard on access ports and root guard on uplinks?

[Gopinath_Pigili]

Yes...

Thanks