Bpdu Guard; Enabling Bpdu Guard - Cisco IE-4000 Software Configuration Manual

Configuring Optional Spanning-Tree Features
Information About Configuring the Optional Spanning-Tree Features
Figure 44 PortFast-Enabled Interfaces
Workstations

BPDU Guard

The BPDU guard feature can be globally enabled on the switch or can be enabled per port, but the feature operates with
some differences.
At the global level, you enable BPDU guard on PortFast-enabled ports by using the spanning-tree portfast bpduguard
default global configuration command. Spanning tree shuts down ports that are in a PortFast-operational state if any
BPDU is received on them. In a valid configuration, PortFast-enabled ports do not receive BPDUs. Receiving a BPDU on
a PortFast-enabled port means an invalid configuration, such as the connection of an unauthorized device, and the BPDU
guard feature puts the port in the error-disabled state. When this happens, the switch shuts down the entire port on
which the violation occurred.
To prevent the port from shutting down, you can use the errdisable detect cause bpduguard shutdown vlan global
configuration command to shut down just the offending VLAN on the port where the violation occurred.
At the interface level, you enable BPDU guard on any port by using the spanning-tree bpduguard enable interface
configuration command without also enabling the PortFast feature. When the port receives a BPDU, it is put in the
error-disabled state.
The BPDU guard feature provides a secure response to invalid configurations because you must manually put the
interface back in service. Use the BPDU guard feature in a service-provider network to prevent an access port from
participating in the spanning tree.

Enabling BPDU Guard

When you globally enable BPDU guard on ports that are Port Fast-enabled (the ports are in a Port Fast-operational state),
spanning tree continues to run on the ports. They remain up unless they receive a BPDU.
In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port
means an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the
port in the error-disabled state. When this happens, the switch shuts down the entire port on which the violation
occurred.
To prevent the port from shutting down, you can use the errdisable detect cause bpduguard shutdown vlan global
configuration command to shut down just the offending VLAN on the port where the violation occurred.
The BPDU guard feature provides a secure response to invalid configurations because you must manually put the port
back in service. Use the BPDU guard feature in a service-provider network to prevent an access port from participating
in the spanning tree.
Port
Fast-enabled
ports
Workstations
354
Server
Port
Fast-enabled port