STP - BPDUGuard, BPDUFilter, and Portfast
BPDUGuard and BPDUFilter are two features of Spanning Tree Protocol (STP) that are used to change the way a switchport deals with BPDUs. The behavior of each changes slightly based on whether or not the PortFast feature is enabled. The following list describes the behavior in each case:
BPDUFilter:
- When enabled globally, PortFast interfaces will not send or receive any BPDUs. If a BPDU is received on an interface configured with PortFast, it loses its PortFast status, disables BPDU filtering and acts as a normal interface. Note that it will only take effect on interfaces configured with PortFast. All other interfaces will remain unaffected.
- When enabled on an interface, the port will simply ignore incoming BPDUs and will not send any BPDUs. If PortFast is enabled on such a port, it is simply ignored. Such a configuration is equivalent of disabling spanning-tree.
BPDUGuard:
- When enabled globally using the
spanning-tree portfast bpduguard defaultcommand in global configuration mode, it enables BPDUGuard on all interfaces configured with PortFast. All other interfaces remain unchanged. - When enabled on a per-interface basis, such interfaces will not send out any BPDUs. If they receive a BPDU, they will go into an err-disabled state. This configuration can be applied to ports whether they are configured with PortFast or not.
Links:
https://networklessons.com/spanning-tree/spanning-tree-bpduguard
https://networklessons.com/spanning-tree/spanning-tree-bpdufilter
https://www.cisco.com/en/US/docs/switches/metro/me3600x_3800x/trash/swstpopt.html#wp1095752
https://www.cisco.com/en/US/docs/switches/metro/me3600x_3800x/trash/swstpopt.html#wp1046220