STP - BPDUGuard, BPDUFilter, and Portfast

BPDUGuard and BPDUFilter are two features of Spanning Tree Protocol (STP) that are used to change the way a switchport deals with BPDUs. The behavior of each changes slightly based on whether or not the PortFast feature is enabled. The following list describes the behavior in each case:


  • When enabled globally, PortFast interfaces will not send or receive any BPDUs. If a BPDU is received on an interface configured with PortFast, it loses its PortFast status, disables BPDU filtering and acts as a normal interface. Note that it will only take effect on interfaces configured with PortFast. All other interfaces will remain unaffected.
  • When enabled on an interface, the port will simply ignore incoming BPDUs and will not send any BPDUs. If PortFast is enabled on such a port, it is simply ignored. Such a configuration is equivalent of disabling spanning-tree.


  • When enabled globally using the spanning-tree portfast bpduguard default command in global configuration mode, it enables BPDUGuard on all interfaces configured with PortFast. All other interfaces remain unchanged.
  • When enabled on a per-interface basis, such interfaces will not send out any BPDUs. If they receive a BPDU, they will go into an err-disabled state. This configuration can be applied to ports whether they are configured with PortFast or not.