I do not understand why we use portfast and in fact STP on the interface of a switch that is directly connected to end users. Indeed, a user can interfere with the STP election and perform DDoS (that is prevented by BPDU Guard).

This is just not possible to disable STP on the interface that face the client ? Why portfast and STP are perform on interfaces that face end users ?

I'm not really good with layer 2. Thanks for your help.

  • Can you please provide some diagrams and relevant configuration parts? – Teun Vink Oct 30 '18 at 13:36
  • 1
    On Cisco equipment you can disable portfast on a switchport by using no spanning-tree portfast you have to actively enable it, as it's disabled by default. – user36472 Oct 30 '18 at 13:39
  • 1
    By default, spanning tree runs on every port. The spanning tree feature cannot be turned off on switches on a per port basis. Although it is not recommended, you can turn off Spanning Tree Protocol (STP) on a per-VLAN basis, or globally on the switch. Use the no spanning-tree vlan vlan-id command in order to disable STP on a per virtual LAN (VLAN) basis. – user36472 Oct 30 '18 at 13:43

Portfast is used to decrease the time it takes for the port to move into forwarding mode. BPDU Guard will prevent DDoS or incorrect cabling. Both features are used to prevent loops in a network, while saving time on ports that connect to end user devices. Disabling STP will do exactly the opposite, open the possibility of having loops. A loop can easily bring down the whole network, either intentionally or by accident. If a switch is installed in a perfect world, where no one ever makes a mistake, then yes, you can disable STP on the switch.

  • Ok, but why enable STP on an interface with BPDU Guard (that disable interface when receiving BPDU message) if they cannot exchange BPDU ? – Eraseth Oct 30 '18 at 14:00
  • Can you explain your question? STP is not actively running on an Interface if you have enabled Port Fast with BPDU Gaurd. It will not try to discover switches on the Port. – Abu Zaid Oct 30 '18 at 14:12
  • "STP is not actively running on an Interface if you have enabled Port Fast with BPDU Gaurd." Yes ! So why just not disable STP this interface ? (Sorry, I am not accustomed with L2) – Eraseth Oct 30 '18 at 14:15
  • 1
    BPDU Guard is feature of STP, if you disable STP, there will be no protection from Loops. – Abu Zaid Oct 30 '18 at 14:18
  • 3
    They are not ignored, as soon the switch receives a BPDU, it will error disable the port. – Abu Zaid Oct 30 '18 at 14:23

Without portfast:

000058: Oct 30 2018 15:06:31.556 EDT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to up
000059: Oct 30 2018 15:06:32.558 EDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to up
000060: Oct 30 2018 15:06:59.639 EDT: %SPANTREE-5-TOPOTRAP: Topology Change Trap for instance 0

Port 17 (GigabitEthernet1/0/17) of MST0 is designated learning
Port 17 (GigabitEthernet1/0/17) of MST0 is designated forwarding

It takes about 30s for the port to enter forwarding state. During this period, no traffic flows. This is a problem for end-hosts that are doing things like DHCP and DAD (duplicate-address-detection.) With portfast, the port immediately goes into the forwarding state, but still performs the same BPDU loop detection. However there may be a few seconds where a loop could exist, thus Cisco emits the following warning:

sw-R2-1(config-if)#spanning-tree portfast 
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION

BPDU Guard is a different beast. It's purpose is to prevent anything on the port from participating in spanning-tree. If the STP process sees a BPDU -- even it's own -- the port will be err-disabled. (It's part of the spanning-tree process, so STP has to be enabled.)

000069: Oct 30 2018 15:20:58.662 EDT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to up
000070: Oct 30 2018 15:20:59.663 EDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to up
000071: Oct 30 2018 15:21:00.979 EDT: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi1/0/17 with BPDU Guard enabled. Disabling port.
000072: Oct 30 2018 15:21:00.979 EDT: %PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/17, putting Gi1/0/17 in err-disable state
000073: Oct 30 2018 15:21:02.044 EDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/17, changed state to down
000074: Oct 30 2018 15:21:03.050 EDT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/17, changed state to down

sw-R2-1#show int g1/0/17  
GigabitEthernet1/0/17 is down, line protocol is down (err-disabled) 
  • (300s later) 000076: Oct 30 2018 15:26:01.056 EDT: %PM-4-ERR_RECOVER: Attempting to recover from bpduguard err-disable state on Gi1/0/17 (and MST0 is alternate blocking because it is, technically, a loop, but adtran and cisco don't agree -- if they were two ciscos, cdp would err-disable the port for a vlan mismatch) – Ricky Beam Oct 30 '18 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.