Cisco PortFast, BPDU Guard and Root Guard Explained

Spanning tree protects a redundant network from loops, but on host-facing ports it creates problems of its own: a workstation plugged in forces the port through 30 seconds of listening and learning, and a rogue switch plugged into an access port can hijack the root bridge role. Cisco's answer is a family of edge protections — PortFast, BPDU Guard, Root Guard and Loop Guard — that this article configures and verifies using Cisco's official documentation as the reference.

PortFast: Skip the STP Delay on Host Ports

PortFast moves a port straight to forwarding, skipping listening and learning. It is only safe on ports that connect end devices and will never see another switch:

CatSwitch-IOS(config)# interface GigabitEthernet1/0/1
CatSwitch-IOS(config-if)# spanning-tree portfast

PortFast should always be combined with BPDU Guard — a PortFast port that receives a BPDU is a topology mistake or an attack, and the guard turns that port off instead of letting it participate.

BPDU Guard: Shut Down Ports That Receive BPDUs

Per interface, or globally so every PortFast port inherits the guard:

CatSwitch-IOS(config-if)# spanning-tree bpduguard enable
CatSwitch-IOS(config)# spanning-tree portfast bpduguard default

When a BPDU arrives on a guarded port, STP moves the port to errdisable instead of blocking — the port stays down until an administrator intervenes. Automate recovery with errdisable timeout so a fixed cable does not require a truck roll:

CatSwitch-IOS(config)# errdisable recovery cause bpduguard
CatSwitch-IOS(config)# errdisable recovery interval 400

Ports then re-enable automatically 400 seconds after the cause clears (default interval 300 s). For the adjacent topic of locking down MAC addresses on these same access ports, our port security sticky MAC guide is the natural companion.

Root Guard: Protect the Root Bridge Role

Any switch can become root if its bridge ID wins the election, and an attacker who plugs in a switch with priority 0 silently reroutes your whole topology. Root Guard makes a port refuse superior BPDUs — if one arrives, the port moves to root-inconsistent (blocking) state until the offending BPDUs stop:

CatSwitch-IOS(config)# interface GigabitEthernet3/1
CatSwitch-IOS(config-if)# spanning-tree guard root

Apply Root Guard on ports facing areas where the root must never appear — access switches and untrusted segments. Loop Guard (spanning-tree guard loop) complements it by blocking ports that stop receiving BPDUs due to unidirectional links rather than a real topology change.

Verification Commands

CatSwitch-IOS# show spanning-tree summary totals
CatSwitch-IOS# show spanning-tree inconsistentports
CatSwitch-IOS# show errdisable recovery
CatSwitch-IOS# show interfaces status | include err-disabled

show spanning-tree summary totals confirms "PortFast BPDU Guard is enabled"; the inconsistentports output lists any port currently held in root-inconsistent or loop-inconsistent state. Together these four protections turn a fragile STP domain into one where a misconfigured or malicious device can only hurt itself. Cross-vendor equivalents and more CLI patterns are in our multi-vendor cheat sheet.

原文链接：https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10586-65.html