Cisco Ccnp / Bcmsn Exam Tutorial: Configuring PortFast And Bpdu Guard
In your Ccna studies, you learned about PortFast and the issue it can cause if configured on the wrong port! favorable only for switch ports related directly to a particular host, PortFast allows a port running Stp to go directly from blocking to forwarding mode.
A Cisco router will give you a warning when you configure PortFast:
Sw1(config)#int fast 0/5
Sw1(config-if)#spanning-tree portfast
%Warning: portfast should only be enabled on ports related to a
single host. Connecting hubs, concentrators, switches, bridges, etc...
to this interface when portfast is enabled, can cause temporary
bridging loops. Use with Caution
%Portfast has been configured on FastEthernet0/5 but will only
have follow when the interface is in a non-trunking mode.
Sw1(config-if)#
Not only will the switch warn you about the proper usage of PortFast, but you must put the port into entrance mode before PortFast will take effect.
Now, you'd think that would be sufficient of a warning, right? But there is a chance - just a chance - that someone is going to carry on to connect a switch to a port running Portfast. That could lead to two major problems, the first being the formation of a switching loop. Remember, the reason we have listening and studying modes is to help preclude switching loops. The next question is that there could be a new root bridge elected - and it could be a switch that isn't even in your network!
Bpdu Guard protects against this disastrous possibility. If any Bpdu comes in on a port that's running Bpdu Guard, the port will be shut down and placed into error disabled state, shown on the switch as err-disabled. A port placed in err-disabled state must be reopened manually.
Bpdu Guard is off on all ports by default, and is enabled as shown here:
Sw1(config)#int fast 0/5
Sw1(config-if)#spanning-tree bpduguard enable
It's a good idea to enable Bpdu Guard on any port you're running PortFast on. There's no cost in overhead, and it does preclude the possibility of a switch sending Bpdus into a port configured with PortFast - not to mention the possibility of a switch not under your control becoming a root switch to your network!
cisco router 2600
