BPDU Guard With RSTP Devices

Question

I am attempting to secure our switches with BPDU Guard. I have it enabled and I have a pieces of equipment with 2 NIC ports on them of which they can be daisy chained together for data collection. When I plug in one of these devices, the port it is plugged into it throws a BPDU alert and sets the port to err-disable. As far as I know this will continue to happen if I used these devices. Does this mean I can't employ BPDU Guard or is there something we can do to keep the BPDU Guard on and plug in these devices?

Answer 1

bpdu-guard disables a port when it receives (unwanted) BPDUs. That is its design. You cannot use bpdu-guard with devices that you expect to emit BPDUs in general. The only way to keep bpdu-guard enabled productively is to make those device stop sending BPDUs.

If you want to ignore BPDUs from a port you should instead use bpdu-filter (ignoring BPDUs generally, effectively disabling STP for that port) and/or tcn-guard (just ignoring topology change notifications), in combination with root-guard (preventing a port to become root port).

If you must filter BPDUs but still need to have loop detection, some devices feature a loop guard that disables a port when it detects a loop (usually by sending out and potentially receiving signed probing frames). Other damage control measures for loops include limiting broadcast rates.