How do you configure spanning tree port fast bpdu root guard on cisco 3560 switch? Can anyone tell me if there's any difference in the configuration of stp port fast bpdu root guard in cisco 3560 and 2960 switches?


2 Answers 2


Use spanning-tree portfast, and spanning-tree bpduguard enable on each switchport. Root guard is unnecessary on ports with this configuration, because bpduguard will err-disable the port when you receive any bpdus.

Use root guard on links to other switches, which are not planned for the primary or secondary stp root role.

  • 1
    Matter of personal preference, but on any newer platform (2960 or later), I use spanning-tree portfast bpduguard default in global configuration. This automatically applies to any switchport with portfast enabled, which is generally what I want. You can then do a spanning-tree bpduguard disable on the ports where you don't want it.
    – YLearn
    May 28, 2014 at 22:36
  • @YLearn Agreed, in fact, most organizations explicitly require those as default parameters.
    – Ryan Foley
    May 29, 2014 at 6:57

As an aside and since I cannot leave comments yet, I prefer to use switchport host when setting up access ports. The switchport host command is a macro on all Cisco switches. it sets the port up as an accessport, spanning-tree portfast, and disables etherchannel capabilities.

Once you've used the switchport host command your can then run whatever additional commands are needed such as spanning-tree bpduguard enable or spanning-tree bpduguard enable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.