Cisco PortFast, BPDU Guard and Root Guard Explained

Spanning tree protects a redundant network from loops, but on host-facing ports it creates problems of its own: a workstation plugged in forces the port through 30 seconds of listening and learning, and a rogue switch plugged into an access port can hijack the root bridge role. Cisco's answer is a family of edge protections — PortFast, BPDU Guard, Root Guard and Loop Guard — that this article configures and verifies using Cisco's official documentation as the reference.

PortFast: Skip the STP Delay on Host Ports

PortFast moves a port straight to forwarding, skipping listening and learning. It is only safe on ports that connect end devices and will never see another switch:

CatSwitch-IOS(config)# interface GigabitEthernet1/0/1
CatSwitch-IOS(config-if)# spanning-tree portfast

On a switch with hundreds of access ports, enabling PortFast interface by interface is not practical. Two shortcuts do the same job. The switchport host macro sets the port to access mode, enables PortFast and disables channel negotiation in one command, which makes it the safest single line to run on a port you have just provisioned. The global default enables PortFast on every access port that is not a trunk:

CatSwitch-IOS(config-if)# switchport host
switchport mode will be set to access
spanning-tree portfast will be enabled
channel group will be disabled

CatSwitch-IOS(config)# spanning-tree portfast default
CatSwitch-IOS(config)# interface range GigabitEthernet1/0/1 - 24
CatSwitch-IOS(config-if-range)# spanning-tree portfast

The global form applies only to ports in access mode. A port running 802.1Q trunking is never made PortFast by the default command, which is exactly the behaviour you want — a trunk that skipped listening and learning would create an immediate loop. Confirm the result with show spanning-tree interface GigabitEthernet1/0/1 detail, which reports the port role, state and whether PortFast was configured explicitly or inherited from the global default.

PortFast should always be combined with BPDU Guard — a PortFast port that receives a BPDU is a topology mistake or an attack, and the guard turns that port off instead of letting it participate.

BPDU Guard: Shut Down Ports That Receive BPDUs

Per interface, or globally so every PortFast port inherits the guard:

CatSwitch-IOS(config-if)# spanning-tree bpduguard enable
CatSwitch-IOS(config)# spanning-tree portfast bpduguard default

The two forms are not identical. The interface form enables the guard unconditionally, even if PortFast is not active on that port. The global form enables the guard only on ports that are actually running PortFast. In a well-designed access layer you normally configure the global form and let individual access ports inherit protection, then verify that trunks and uplinks are excluded.

When a BPDU arrives on a guarded port, STP moves the port to errdisable instead of blocking — the port stays down until an administrator intervenes. The switch also generates a log message that names the port and the cause, which is the fastest way to find the device that was plugged in by mistake:

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port GigabitEthernet1/0/13 with BPDU Guard enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/13, putting Gi1/0/13 in err-disable state

Automate recovery with errdisable timeout so a fixed cable does not require a truck roll:

CatSwitch-IOS(config)# errdisable recovery cause bpduguard
CatSwitch-IOS(config)# errdisable recovery interval 400
CatSwitch-IOS# show errdisable recovery

Ports then re-enable automatically 400 seconds after the cause clears (default interval 300 s). Before you enable automatic recovery, decide what you want the port to do: a lab or a desk port benefits from auto-recovery, while a port in a data centre row where nobody will physically unplug the offending device can be left disabled so the fault stays visible. For the adjacent topic of locking down MAC addresses on these same access ports, our port security sticky MAC guide is the natural companion, and the violation-mode differences are covered in Cisco port security violation modes.

BPDU Filter: The Risky Cousin

BPDU Filter is often confused with BPDU Guard, but it does the opposite thing. Rather than shutting the port down when a BPDU arrives, the filter stops BPDUs from being sent or received on the port at all. The port keeps forwarding, and the switch silently ignores the fact that a second switch has appeared:

CatSwitch-IOS(config-if)# spanning-tree bpdufilter enable
CatSwitch-IOS(config)# spanning-tree portfast bpdufilter default

Configured globally, the filter removes a PortFast port from the STP domain. That is exactly what you want for a port facing a device that must never form a loop, and exactly what makes a loop possible when someone plugs in a switch by accident: nothing detects the loop until the MAC address table starts flapping. Use BPDU Guard on user-facing ports and reserve BPDU Filter for the rare case where a service provider or an appliance insists on seeing no STP frames.

Root Guard: Protect the Root Bridge Role

Any switch can become root if its bridge ID wins the election, and an attacker who plugs in a switch with priority 0 silently reroutes your whole topology. Root Guard makes a port refuse superior BPDUs — if one arrives, the port moves to root-inconsistent (blocking) state until the offending BPDUs stop:

CatSwitch-IOS(config)# interface GigabitEthernet3/1
CatSwitch-IOS(config-if)# spanning-tree guard root

Apply Root Guard on ports facing areas where the root must never appear — access switches and untrusted segments. Do not apply it on the two links that carry the root bridge's own BPDUs or you will isolate your own topology: Root Guard is a one-way filter that never blocks the current root, but it will block a port that starts advertising a better bridge ID, including after a legitimate re-election. The log and state change look like this:

%SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port GigabitEthernet3/1 on VLAN0040.
%SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port GigabitEthernet3/1.

CatSwitch-IOS# show spanning-tree inconsistentports

Name                 Interface              Inconsistency
-------------------- ---------------------- ------------------
VLAN0040             GigabitEthernet3/1     Root Inconsistent

The design rules for choosing priority values that keep the intended root in place are covered in Spanning Tree Root Bridge Election and Design Rules; Root Guard is the enforcement mechanism, not a substitute for correct priorities.

Loop Guard: Detect Unidirectional Links

Loop Guard solves a different failure. If a fibre strand breaks, a GBIC fails or a cut-through media converter drops traffic one way, a blocking port may stop receiving BPDUs. Without any BPDUs to age out, classic STP can move that port to forwarding while the other side is still forwarding, and the loop forms in the data plane:

CatSwitch-IOS(config-if)# spanning-tree guard loop
CatSwitch-IOS(config)# spanning-tree loopguard default

Loop Guard holds such a port in loop-inconsistent state instead of letting it forward. The three guard types are mutually exclusive on the same interface — a port can run Root Guard or Loop Guard, not both — and Loop Guard belongs on point-to-point links between switches, most usefully on the redundant link in an access closet. Where UDLD is available, run it alongside Loop Guard: UDLD detects the unidirectional condition at Layer 1 and forces the port down, while Loop Guard keeps STP from reacting badly in the seconds before that happens. The configuration differences between UDLD normal and aggressive mode are explained in Cisco UDLD configuration: normal vs aggressive mode.

Which Guard Goes on Which Port

The single most common deployment error is applying one guard everywhere. Match the protection to the port role instead:

The same logic in IOS is available on other platforms under different names, and the equivalents are listed in our multi-vendor CLI cheat sheet. If you run Arista in the same network, the EOS command set for edge ports is documented in Arista EOS PortFast and BPDU Guard setup.

Common Mistakes and Troubleshooting

Most "STP is broken" tickets in an access layer come down to a handful of causes, and each has a distinctive signature:

• Port flapping in and out of err-disable every few minutes. Something is sending BPDUs continuously. Look for a small unmanaged switch, a wireless mesh AP in bridge mode, or a virtualisation host with a bridged vSwitch on the port. Read the syslog entries around the err-disable event to identify the MAC of the offender.
• A whole VLAN loses its gateway for 30 seconds after an access switch reboots. The port became root, which means Root Guard is missing on the downlink or the distribution switch has a bad priority. Check show spanning-tree vlan 40 on the distribution switch first, then add Root Guard.
• PortFast enabled on a trunk. Non-PortFast trunks are normal; if you see a trunk forwarding immediately, check show spanning-tree interface <intf> detail for "portfast" and remove it. This is one of the classic causes of a temporary loop that STP troubleshooting sessions usually start with.
• Ports stuck in loop-inconsistent. Usually a genuinely unidirectional link, occasionally a mismatched duplex or a flapping SFP. Clear the SFP, then check show interfaces counters errors for late collisions and CRCs.
• err-disable recovery enabled but the port comes back and immediately drops again. That is correct behaviour: the offending device is still connected. Recovery is a convenience for cable problems, not a way to keep an unwanted switch online.

Verification Commands

CatSwitch-IOS# show spanning-tree summary totals
CatSwitch-IOS# show spanning-tree inconsistentports
CatSwitch-IOS# show errdisable recovery
CatSwitch-IOS# show interfaces status | include err-disabled
CatSwitch-IOS# show spanning-tree interface GigabitEthernet1/0/1 detail
CatSwitch-IOS# show spanning-tree vlan 40
CatSwitch-IOS# show run interface GigabitEthernet1/0/1

show spanning-tree summary totals confirms "PortFast BPDU Guard is enabled"; the inconsistentports output lists any port currently held in root-inconsistent or loop-inconsistent state. Together these four protections turn a fragile STP domain into one where a misconfigured or malicious device can only hurt itself. Cross-vendor equivalents and more CLI patterns are in our multi-vendor cheat sheet.

FAQ

Does BPDU Guard work on a port without PortFast? Yes, if you configure it per interface with spanning-tree bpduguard enable. The global portfast bpduguard default form only affects PortFast ports.

Can I use Root Guard and Loop Guard together? No, they are mutually exclusive on the same interface. Root Guard goes on the port facing downstream switches; Loop Guard goes on the redundant point-to-point link where a unidirectional failure is possible.

What is the difference between err-disable from BPDU Guard and a root-inconsistent port? Err-disable takes the port administratively down and requires a recovery action (manual or timed). Root-inconsistent is an STP blocking state that clears automatically as soon as the superior BPDUs stop arriving.

Should I enable BPDU Guard globally on a switch with server trunks? Configure the global default, then explicitly disable it on ports facing servers or hypervisors via no spanning-tree bpduguard enable on the interface. This keeps the default protection for desks while allowing the few devices that legitimately run bridging software.

原文链接：https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10586-65.html