Cisco Catalyst 4500 Series - Enabling BPDU Guard on a Specified Interface

26-16
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 26 Configuring Optional STP Features
About PortFast Edge BPDU Filtering
Extended system ID is enabled
PortFast Edge BPDU Guard Default is enabled
Portfast Edge BPDU Filter Default is disabled
Portfast Default is edge
Bridge Assurance is enabled
Loopguard is disabled
UplinkFast is disabled
BackboneFast is disabled
Pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
2 vlans 0 0 0 3 3
Enabling BPDU Guard on a Specified Interface
About PortFast Edge BPDU Filtering
Cisco IOS Release 12.2(31)SGA and later support PortFast edge BPDU filtering, which allows the
administrator to prevent the system from sending or even receiving BPDUs on specified ports.
When configured globally, PortFast edge BPDU filtering applies to all operational PortFast edge ports.
Ports in an operational PortFast edge state are supposed to be connected to hosts that typically drop
BPDUs. If an operational PortFast edge port receives a BPDU, it immediately loses its operational
PortFast edge status. In that case, PortFast edge BPDU filtering is disabled on this port and STP resumes
sending BPDUs on this port.
PortFast edge BPDU filtering can also be configured on a per-port basis. When PortFast edge BPDU
filtering is explicitly configured on a port, it does not send any BPDUs and drops all BPDUs it receives.
Caution Explicitly configuring PortFast edge BPDU filtering on a port that is not connected to a host can result
in bridging loops, because the port ignores any BPDU it receives and goes to the forwarding state.
When you enable PortFast edge BPDU filtering globally and set this port configuration as the default for
PortFast edge BPDU filtering (see the “Enabling BackboneFast” section on page 26-23), PortFast
enables or disables PortFast edge BPDU filtering.
Command Purpose
Step 1
Switch# configure terminal
Enters global configuration mode.
Step 2
Switch(config)# interface {{fastethernet |
gigabitethernet | tengigabitethernet} slot/port} |
{port-channel port_channel_number}
Specifies an interface to configure.
Step 3
Switch(config-if)# spanning-tree portfast edge
bpduguard default
Enables BPDU Guard on the specified edge port.
Use the no keyword to disable BPDU guard.
Step 4
Switch(config)# end
Exits configuration mode.
Step 5
Switch# show spanning-tree summary
Verifies the BPDU configuration.