0

I am attempting to secure our switches with BPDU Guard. I have it enabled and I have a pieces of equipment with 2 NIC ports on them of which they can be daisy chained together for data collection. When I plug in one of these devices, the port it is plugged into it throws a BPDU alert and sets the port to err-disable. As far as I know this will continue to happen if I used these devices. Does this mean I can't employ BPDU Guard or is there something we can do to keep the BPDU Guard on and plug in these devices?

1
  • Sounds like this "equipment" is sending BPDUs. But you've provided so little detail, it's really impossible to tell for sure. – Ron Trunk Apr 15 at 12:01
3

bpdu-guard disables a port when it receives (unwanted) BPDUs. That is its design. You cannot use bpdu-guard with devices that you expect to emit BPDUs in general. The only way to keep bpdu-guard enabled productively is to make those device stop sending BPDUs.

If you want to ignore BPDUs from a port you should instead use bpdu-filter (ignoring BPDUs generally, effectively disabling STP for that port) and/or tcn-guard (just ignoring topology change notifications), in combination with root-guard (preventing a port to become root port).

If you must filter BPDUs but still need to have loop detection, some devices feature a loop guard that disables a port when it detects a loop (usually by sending out and potentially receiving signed probing frames). Other damage control measures for loops include limiting broadcast rates.

2
  • So leaving BPDU guard on I can still have "guard root" on as well as a number of other STP methods correct? – JukEboX Apr 15 at 12:47
  • 1
    Yes - generally, you can use a couple of other features to secure STP, as alternatives to (the rather blunt) bpdu-guard. I'd recommend using root-guard and tcn-guard an edge ports (and even on most intermediate ports) in any case. – Zac67 Apr 15 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.