Portfast, Root Guard, BPDU Filter and BPDU Guard

Portfast, Root Guard, BPDU Filter and BPDU Guard

The are various mechanims like BPDU Filter, BPDU Guard, Root Guard, Portfast etc. used with STP to provide stable STP topology. In this lesson, we will focus on what are these Spanning Tree Mechanims and what they do to provide a stable STP Topology. To learn about other STP Convergence Mechanism, you can visit Loop Guard | Uplink Fast | Backbone Fast | UDLD lessons.

So, what are these STP Convergence Mechanims? These STP Convergence Mechanims are given below:

• PortFast
• BPDU Guard
• BPDU Filter
• Root Guard
• Loop Guard
• Uplink Fast
• Bachbone Fast
• UDLD

 

Now, let’s talk about these STP Convergence Mechanims one by one detailly.

---

 

What is PortFast?

As we have discussed before, in STP (Spanning Tree Protocol) there are five port states. These Port States are :

• Blocking State
• Listening State
• Learning State
• Forwarding State

 

In an STP Topology, this Layer 2 convergence time, accessing from blocking to forwarding state,is 50 seconds. These 50 seconds are spend in the states like below:

• Blocking State : 20 seconds
• Listenning State : 15 seconds
• Learning State : 15 seconds

 

Total 50 seconds From Blocking State to Forwarding State.

To reduce this time, STP Portfast is used on the access ports connected to host devices like pc, laptops, printers, servers etc. With STP Portfast, Blocking State, Listenning State and Learning State are bypassed. So, the ports enters the Forwarding State immediately.

 

STP Portfast is used on only access ports. It is not recommended to use SP Port Fast on trunk ports. Also on the port that is connected to another switch is not recommended. Because, such a connection can cause an unaccepted Layer 2 Loop.

To configure STP Portfast Globally, you can use “spanning-tree portfast default” command globally. This will configure all switch ports with PortFast and put all the switch ports into Forwarding rapidly.

To configure PortFast on a specific interface, you can use “spanning-tree portfast” under this specific interface.

What is BPDU Guard?

BPDU Guard is the mechanims that protect a port towards any Bridge Protocol Data Unit. In other words, this mechanims avoid receiving BPDU packets. By doing this, BPDU Guard provide the stability of STP Topology.

 

BPDU Guard avoid receiving BPDU with an Error-Disabled Mode. If a BPDU Guard configured port receives a BPDU packet, it puts this port into Error-Disabled Mode.

It is configured on the related port of a Cisco switches with “spanning-tree bpduguard enabled” command.

 

Switch(config-if)# spanning-tree bpduguard enabled

 

You can also enable BPDU Guard globally on a Cisco switch, with “spanning-tree portfast bpduguard default” command.

What is BPDU Filter?

BPDU Filter mechanims is used to provide also a stable Spanning Tree Protocol Topology. It avoids receiving BPDUs on the interfaces and it also provide that device not participate in STP even if it is a witch. This is useful also with Port Fast configured ports.

 

BPDU Filter removes Port Fast on the port, if it receives a BPDU packet. After that, it operates with normal STP.

 

This is a little risky feature. Because if you connect a switch to a switch network this can cause a loop.

What is Root Guard?

Root Guard is the Spanning Tree mechanism that prohibits an undesired switch to become a root bridge. In other words, with Root Guard, network administrators can manuplate Root Bridge selection.

 

Root Guard mechanims is an important mechanims that avoids Root Bridge changes in undesired times. Think about it. If a superiour BPDU comes and says that, there is a better Root Bridge. This can cause unexpected problems in a network.

 

 

With Root Guard mechanims, STP topology and Root Bridge stay stable and unexpected problems caused by a Root Bridge change is avoided. Root Guard puts the port that received an unwanted BPDU (Bridge Protocol Data Unit), it puts that port in an “inconsistent state”.

 

To configure a port with Root Guard, you can use “spanning-tree guard root” command under the related interface.

To check the interfaces that is in the inconsistent state, you can use “show spanning-tree inconsistentports” command.

 

Switch# show spanning-tree inconsistentports