How do you configure spanning tree port fast bpdu root guard on cisco 3560 switch? Can anyone tell me if there's any difference in the configuration of stp port fast bpdu root guard in cisco 3560 and 2960 switches?
2 Answers
Use spanning-tree portfast, and spanning-tree bpduguard enable on each switchport. Root guard is unnecessary on ports with this configuration, because bpduguard will err-disable the port when you receive any bpdus.
Use root guard on links to other switches, which are not planned for the primary or secondary stp root role.
answered May 27, 2014 at 11:27
-
1Matter of personal preference, but on any newer platform (2960 or later), I use
spanning-tree portfast bpduguard defaultin global configuration. This automatically applies to any switchport with portfast enabled, which is generally what I want. You can then do aspanning-tree bpduguard disableon the ports where you don't want it.– YLearnMay 28, 2014 at 22:36 -
@YLearn Agreed, in fact, most organizations explicitly require those as default parameters. May 29, 2014 at 6:57
As an aside and since I cannot leave comments yet, I prefer to use switchport host when setting up access ports. The switchport host command is a macro on all Cisco switches. it sets the port up as an accessport, spanning-tree portfast, and disables etherchannel capabilities.
Once you've used the switchport host command your can then run whatever additional commands are needed such as spanning-tree bpduguard enable or spanning-tree bpduguard enable.
