BPDU guard
Every 2 seconds we send a BPDU on very port. BPDU guard does the following “whenever you recieve a BPDU on this port, disable it (put it in an error disabled state)”
Turn on BPDU guard on every interface where no switch is connected! So for the future, whenever there gets a switch connected you have the port getting error disabled.
Why disable and enable when we have the “no spanning-tree…”
We enable BPDU Guard on Edge Ports to protect our network from loops and unauthorized switches. You can enable BPDU guard by default on every portfast ports.
We disable BPDU Guard on uplink/trunk ports (ports connected to other legitimate, authorized switches).
How to get out of error-disabled state?
- Global config mode
- Interface
- Shutdown
- No shutdown
PortFast
You want to turn on PortFast on any interface which does NOT connect to another switch.
Spanning-tree portfast -> turns off spanning-tree
Spanning-tree portfast default -> enable portfast by default an all ACCESS ports
Cisco IOS commands learned in this chapter
| Command | Description | |||
| interface GigabitEthernet0/1 | ||||
| spanning-tree | Portfast | Enables PortFast on the specific interface | ||
| Spanning-tree | Bpduguard | Disable | Disables BPDU Guard on that specific interface | |
| Shutdown | Shutsdown the interface | |||
| No shutdown | Brings the interface up | |||
| Spanning-tree | Portfast | Default | Enables PortFast globally on all access ports | |
| Spanning-tree | Portfast | Bpduguard | Default | enable BPDU guard by default on every portfast ports |