I'm trying to understand if two ports on the same switch, are in portfast mode, will a loop be created when the two ports are connected to each other. i.e. if FastEthernet 0/2 and 0/3 are both set to portfast and are then connected via an ethernet cable directly to each other, or via a hub, will one of the ports go into 'blocking'.

I've tested this behavior using Cisco's Packet Tracer and FastEthernet 0/3 ends up being blocked. Below is an excerpt from the running config:

spanning-tree mode rapid-pvst
interface FastEthernet0/1
interface FastEthernet0/2
 spanning-tree portfast
interface FastEthernet0/3
 spanning-tree portfast

The following is the show spanning-tree output:

Switch#show spanning-tree 
  Spanning tree enabled protocol rstp
  Root ID    Priority    32769
             Address     0060.3EB7.B631
             Cost        19
             Port        1(FastEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     00D0.D315.4BD5
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  20

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/3            Altn BLK 19        128.3    Shr
Fa0/2            Desg FWD 19        128.2    Shr
Fa0/1            Root FWD 19        128.1    P2p


If the behavior described above, is expected when using portfast, what advantage is there to using bpduguard? As it would appear a lot sources recommend using portfast and bpduguard together.

  • 1
    portfast and bpduguard are two very different (and independent) things. I see this sort of question ALL. THE. TIME. Cisco's documentation is freely available. Read it. – Ricky Dec 6 '15 at 8:22

Port fast bypasses the usual STP phases and goes straight into forwarding. This is useful for ports connected to end-devices which use DHCP. It does not stop BPDUs, and there are those who advocate using it on all ports, although Cisco has a different take on it:

Caution: Never use the PortFast feature on switch ports that connect to other switches, hubs, or routers. These connections can cause physical loops, and spanning tree must go through the full initialization procedure in these situations. A spanning tree loop can bring your network down. If you turn on PortFast for a port that is part of a physical loop, there can be a window of time when packets are continuously forwarded (and can even multiply) in such a way that the network cannot recover.

BPDU guard will disable (errdisable) a port which receives BPDUs. The helps to prevent rogue switches and STP loops. Cisco has a document which explains BPDU guard:

Feature Description

STP configures meshed topology into a loop-free, tree-like topology. When the link on a bridge port goes up, STP calculation occurs on that port. The result of the calculation is the transition of the port into forwarding or blocking state. The result depends on the position of the port in the network and the STP parameters. This calculation and transition period usually takes about 30 to 50 seconds. At that time, no user data pass via the port. Some user applications can time out during the period.

In order to allow immediate transition of the port into forwarding state, enable the STP PortFast feature. PortFast immediately transitions the port into STP forwarding mode upon linkup. The port still participates in STP. So if the port is to be a part of the loop, the port eventually transitions into STP blocking mode.

As long as the port participates in STP, some device can assume the root bridge function and affect active STP topology. To assume the root bridge function, the device would be attached to the port and would run STP with a lower bridge priority than that of the current root bridge. If another device assumes the root bridge function in this way, it renders the network suboptimal. This is a simple form of a denial of service (DoS) attack on the network. The temporary introduction and subsequent removal of STP devices with low (0) bridge priority cause a permanent STP recalculation.

The STP PortFast BPDU guard enhancement allows network designers to enforce the STP domain borders and keep the active topology predictable. The devices behind the ports that have STP PortFast enabled are not able to influence the STP topology. At the reception of BPDUs, the BPDU guard operation disables the port that has PortFast configured. The BPDU guard transitions the port into errdisable state, and a message appears on the console.

  • I understand this, however, will portfast disable any ports that are part of a loop? – Hammer Dec 6 '15 at 4:29
  • No. Portfast only bypasses the STP phases. All is explained in the two Cisco documents to which I linked. That's why bpduguard is useful with portfast. – Ron Maupin Dec 6 '15 at 4:32
  • OK, that was my understanding, however, in the lab that I created with Packet Tracer it seems to block the ports, hence, my original question. I wonder if this is a bug in Packet Tracer. Thanks, I'll make sure I'll enable both on edge ports from now on. – Hammer Dec 6 '15 at 4:34
  • That is STP putting the port in blocking. If you had a bunch of traffic on the switch, you could have had a real problem. As it is, you didn't have any real traffic so STP had time to react. – Ron Maupin Dec 6 '15 at 4:37
  • When you say 'real problem', what might happen? Would the switch itself lock-up? Or lock-up until STP kicked in? Could affect any upstream switches? – Hammer Dec 6 '15 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.