7

I have two switches (Cisco 2960's) with a trunk between them (two ports in an ether-channel) and each has a trunk up to a separate router, all other switch ports are access ports to end devices;

R1       R2
|        |
|        |
|        |
SW1 === SW2

I want to implement various STP options, port fast on all ports, BPDU filter and BPDU guard. I have read various Cisco documents and other reputable web site feeds, just a few are;

I wish to configured all access ports as follows, I already know and use these features and so there is no problems here:

int gi0/10
 description End Device Port
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpdufilter enable
 spanning-tree bpduguard enable

I wish to configured trunk ports between switches and up to routers as follows, again I already use this configuration and see no issues here;

int gi0/1
 description Trunk to R1
 switchport mode trunk
 spanning-tree portfast trunk

What I can't find any good documentation on is mixing BPDU filter and BPDU guard as global defaults with ports configured for portfast trunk. To save my self configuring port-fast on every access port with BPDU guard and BPDU filter, I can simply enter these three global configuration commands;

spanning-tree portfast default
spanning-tree portfast bpdufilter default
spanning-tree portfast bpduguard default

BPDU filter and BPDU guard will now become active on all portfast ports, but what about portfast ports that are configured as portfast trunk such as between the switches, I want BPDU's being sent between switches. I can't find any documentation that says if or if not enabling BPDU guard/filter globally will also configure this on portfast trunk ports, which could stop STP running between switches and potentially cause those trunk ports to errdisable.

What happens when this situation is configured and are there any official online Cisco doc's to clarify?

Improve this question
5
  • 3
    Just curious, why BPDU filter and BPDU guard? I've seen utilizing both features at the same time bite folks hard. All it takes is one user bridging two ports and that switch takes a dive. BPDU Guard can't shut down the port if you're stopping all BPDU's with BPDU Filter.
    – Brett Lykins
    Nov 24, 2013 at 14:09
  • 1
    There is no L2 loop here, no point running STP. Like you say, you should just set portfast default (makes all access ports port-fast by default). Like Brett says, I don't think BPDUguard does anything in your config, as when BPDUfilter is configured in port, port already filters incoming BPDU then BPDUguard can never trigger. Global BPDUfilter is different, if it received BPDU it starts also sending them and migrates, but is quiet as long as it does not receive BPDU. You should also control pps of bcast, mcsat and unknown unicast when supported by HW.
    – ytti
    Nov 24, 2013 at 15:40
  • BPDUfilter when configured on an interface effectively diables spanning-tree which sometimes IS a good thing!
    – John Kennedy
    Nov 25, 2013 at 16:17
  • I don't believe I have been clear enough so I will expand - I wanted to configure BPDU Guard because if a switch is attached to an access port for example I want SW1 & SW2 to ignore any BPDU's that come in. I also want BPDU filter enabled so the switches are not sending any BPDUs out on access ports. I see now that BPDU filter though would have been enough. I thought BPDU filter was filtering inbound only BPDUs but still sending them. I see now that BPDU Guard is what I need so that if a BPDU is received the switch will act upon this, as it should never happen on an access port.
    – Baldrick
    Nov 27, 2013 at 12:23
  • @ytti - Don't worry ytti, that hasn't been forgotten, just trying to keep this question simpler :)
    – Baldrick
    Dec 6, 2013 at 17:49

1 Answer 1

Reset to default
14

First, like the others have mentioned you have no bridging loop here due to running a Portchannel. That said, running STP is still fine. Let me clear some confusions on how these commands work on Cisco switches.

spanning-tree portfast trunk

This command is supposed to be run on trunk ports towards non bridging devices, such as a server with multiple VLANs or a router. This command should not be run on trunks towards switches because the port will bypass the listening and learning phase which could potentially create a bridging loop.

If you have an interface configured like this:

interface x/x
spanning-tree portfast
spanning-tree bpdufilter enable
spanning-tree bpduguard enable

BPDU guard will never kick in because BPDU filter is filtering both the outgoing and incoming BPDUs. This also means that the port can never lose its Portfast status which it would normally do if BPDUs were received inbound. If you remove the filter then BPDU guard will kick in and shutdown the port if a BPDU is received. This is done before the port can lose its Portfast operatational state so basically the port will always operate in Porfast operational mode.

If you apply the commands globally instead:

spanning-tree portfast default
spanning-tree portfast bpdufilter default
spanning-tree portfast bpduguard default

The first command enables Portfast on all access ports.

When BPDU filter is applied globally, the difference is that it sends out 11 BPDUs before going silent. Because normally one BPDU is sent out every 2 seconds and the default MaxAge is 20 seconds that means that if there is a device at the other end that can process BPDUs, at least one BPDU would be received when the old BPDU (if there was one) has expired.

If a BPDU is received inbound when BPDU filter is applied globally then the port stops filtering and it will lose its Portfast status.

The BPDU guard default command will only apply to ports that are in a Portfast operational state.

If you combine these three commands together then what will happen is that when a BPDU is received the port loses its BPDU filter, BPDU guard can then kick in. The port will never lose its Portfast operational state because the port is shutdown before.

So you see when applied to the interface BPDU guard can never kick in but if you apply it globally it can.

If you run just Portfast globally and BPDU filter globally then if a BPDU comes in, the port loses the filter and loses the Portfast operational state and will operate as a normal port.

Improve this answer
7
  • BPDUfilter when configured on an interface effectively diables spanning-tree which sometimes IS a good thing!
    – John Kennedy
    Nov 25, 2013 at 16:17
  • Yeah, usually if you want to demarc your L2. However, extreme care must be taken, especially if you do multihoming or you may end up with a bridging loop.
    – Daniel Dib
    Nov 25, 2013 at 17:00
  • 1
    @JohnKennedy I personally agree with Daniel. If you use bpdufilter on any switchport, you should also enable bcast storm-control with action shutdown to ensure there is a guard against accidental loops in the future
    – Mike Pennington
    Nov 25, 2013 at 17:49
  • Indeed I wish I could upvote his answer twice becuase it explains a commonly misunderstood topic rather well
    – John Kennedy
    Nov 25, 2013 at 17:54
  • 1
    I just tried this on a Cat 3560. Firstly, BPDUs are still transmitted on Portfast enabled ports. This is a common misconception. The BPDU Guard default feature will work on all ports in Portfast operational state, including trunks. However, any Portfast enabled interface that receives BPDUs will lose its Portfast operational state. Depending on which side is sending the superior BPDU, one side could lose Portfast while the other would remain in Portfast. Running Portfast on trunks between switches is not a valid configuration, so don't try that. If you run RSTP, convergence will be quick.
    – Daniel Dib
    Nov 27, 2013 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.