1

I am trying to get a thorough understanding of what does happen when a switch is connected to a portfast port on another switch that is part of a stable STP network in case of:

1- the port has no bpduguard.
2- the port has the bpduguard enabled.

I know that in case 1, loops can be formed. but why? And does the port really revert to normal STP operations (LSN/LRN/FWD) as soon as it receives the first bpdu? if so, it technically prevents data forwarding as soon as it receives the 1st bpdu until FWD is reached. In this case, how is this different from bpduguard that will do the same thing (preventing forwarding) after the 1st bpdu?

And in both cases, there could be a duration of time before the 1st bpdu hits the port in question.

So, isn't the loop danger present in all cases?

I know that bpduguard has definitely much better protection by disabling the port completely. However, how is that better than reverting the port back to STP?

I looked on the Internet and even on the SE, however, nothing was clear enough or explanatory of the process in both cases (step by step) as if we are using a Wireshark. Unfortunately, I do not have a new laptop that can handle GNS3 to emulate this myself. and in Packet Tracer, no loops form at all. I guess because no real traffic.

Anyhow, I hope I will find a satisfying answer here.

8
  • "I know that bpduguard has definitely much better protection. But Why and How?" BPDU guard completely disables the interface in an error state. You must shut the interface down and reenable it for it to be functional again.
    – Ron Maupin
    Jun 30, 2023 at 18:44
  • And does the port really revert to normal STP operations (LSN/LRN/FWD) as soon as it receives the first bpdu? (on cisco) The global config command spanning-tree portfast bpdufilter default together with the interface configuration spanning-tree portfast does that, yes. Together with spanning-tree guard root, this feature combination is nearly ideal for a "lively" network where hosts, spanning-tree speaking desktop switches, wireless APs etc are attached, moved and reattached all the time. Jun 30, 2023 at 20:32
  • @Marc'netztier'Luethi Thanks, but I think my main inquiries have not been fully addressed. what I do want to know: 1- isn't there an equal chance in both cases for loop formation before 1st bpdu received? (Yes/No) 2-if Yes, then no difference at this stage, if No, what is the difference? 3- if all bpdu features are off including bpduguard and except portfast, does the port revert back to normal LSN/LRN/FWD. (Yes/No). (to be continued...)
    – Shadi
    Jul 4, 2023 at 12:31
  • @Marc'netztier'Luethi 4- If No, then what does happen in this case, and if Yes, Then STP is going to be stable again even after a bit longer time. So, Is bpduguard really crucial or necessary in the modern fast networks, or just a recommendation? 5- If there is something I am not seeing or I am misunderstanding. what is it? and how does the process happen in both cases (bpduguard on/off) in this case? Thanks again
    – Shadi
    Jul 4, 2023 at 12:32
  • @Marc'netztier'Luethi 7- What does happen if the portfast port does not receive the 1st bpdu for a considerable amount of time for whatever reason? Should not be there a better way to guard the port that disables it immediately without having to wait for the 1st bpdu?
    – Shadi
    Jul 4, 2023 at 12:46

2 Answers 2

0

I know that in case 1, loops can be formed

Simply connecting two switches together, by itself, does not create a loop. The problem is when portfast is enabled, the port does not participate in STP. So the ability to detect and break loops is disabled. If a loop is created, STP can't reliably detect it and break the loop.

I know that bpduguard has definitely much better protection. But Why and How?

Bpduguard will disable the port when bpdus are detected. You must manually re-enable the port.

5
  • Portfast ports do participate in STP, they just skip the initial Learning state.
    – Zac67
    Jun 30, 2023 at 19:42
  • @RonTrunk Thanks, but I think my main inquiries have not been fully addressed. what I do want to know: 1- isn't there an equal chance in both cases for loop formation before 1st bpdu received? (Yes/No) 2-if Yes, then no difference at this stage, if No, what is the difference? 3- if all bpdu features are off including bpduguard and except portfast, does the port revert back to normal LSN/LRN/FWD. (Yes/No). (to be continued...)
    – Shadi
    Jul 9, 2023 at 16:00
  • 4- If No, then what does happen in this case, and if Yes, Then STP is going to be stable again even after a bit longer time. So, Is bpduguard really crucial or necessary in the modern fast networks, or just a recommendation? 5- If there is something I am not seeing or I am misunderstanding. what is it? and how does the process happen in both cases (bpduguard on/off) in this case? Thanks again
    – Shadi
    Jul 9, 2023 at 16:00
  • 6- What does happen if the portfast port does not receive the 1st bpdu for a considerable amount of time for whatever reason? Should not be there a better way to guard the port that disables it immediately without having to wait for the 1st bpdu?
    – Shadi
    Jul 9, 2023 at 16:01
  • I think I am missing something. but as I see it now. portfast with or without bpduguard allows forwarding until 1st bpdu received. then with or without bpdugard forwarding will be stopped. in bpduguard case by disabling the port. otherwise by entering LSN/LRN states. FWD then will be resumed after STP is stable again. So, I see they are different ways to handle it rather than bpduguard being more secure. So, is this correct, or I am missing something as I said. Please elaborate as I am a novice, and can miss what you understand intutively/
    – Shadi
    Jul 9, 2023 at 16:01
0

With spanning tree protocol enabled, a switch port first enters the Learning state when a link comes up. In this state it already learns MAC addresses and listens to BPDUs, learning its spanning tree role, but it does not forward frames yet.

Since that often creates a problem with end nodes that expect full L2 connectivity when a link is up (think of DHCP), you can put the ports in portfast mode (admin-edge-mode on some switches).

In that mode, a port skips Learning state and enters Forwarding state right away after link up. That port still participates in spanning tree protocol but it begins forwarding frames before it actually knows its role in the spanning tree. That way, a loop may go undetected for a short period.

In a nutshell, you should use portfast/admin edge with ports towards end nodes that you don't expect to participate in a loop. Inter-switch ports and especially redundant meshing ports should never be configured for portfast.

bpduguard is also intended to be used with end-node ports, but it disables a port (=physical link down) that BDPUs are received on, either permanently until you reenable the port or for a configured period. It's used to protect against rogue switches or gross misconfiguration in your network. Disabling a port has an impact on your network availability, so it's not for every use case.

Both portfast and bpduguard may be used separately or in combination.

in case the port has no bpduguard, loops can be formed. but why?

As explained above, bpduguard protects against rogue, STP-enabled switches. xSTP cannot detect loops formed by switches/bridges that neither generate nor forward BPDUs. With portfast, an STP-enabled port skips the learning state and starts forwarding before it is able to detect a loop through STP. When it receives the first BPDUs and determines the correct port state, it stops forwarding, ending the loop.

does the port really revert to normal STP operations (LSN/LRN/FWD) as soon as it receives the first bpdu?

The port state algorithm is controlled by received BPDUs, so depending on the outcome, the port enters either state. A portfast port works like any STP-enabled port, just skipping the (safe) learning state to enable immediate forwarding after link up.

6
  • Thanks, Zac67, but I think my main inquiries have not been addressed. I do want to know: 1- isn't there equal chance in both cases for loop formation before 1st bpdu received? (Yes/No) 2- if no bpduguard, does the port revert back to normal LSN/LRN/FWD. (Yes/No). If Yes, 3- Then STP is stable again even after a longer time. So, Is bpduguard really crucial in the modern fast networks or just recommended? 4- If there is something I am not seeing or I am misunderstanding. what is it? and how does the process happen in both cases (bpduguard on/off) in this case? Thanks again.
    – Shadi
    Jul 2, 2023 at 15:56
  • 1: bpduguard does not impede loop detection which portfast does for a short period; 2: w/o bpduguard the port goes through the learning -> forwarding/discarding states (learning skipped with portfast), listening is obsolete with RSTP; 3: bpduguard is more a policy thing than a crucial, technical requirement
    – Zac67
    Jul 2, 2023 at 17:17
  • Thanks again. As I said in a previous comment, I think I am missing something. but as I see it now. portfast with or without bpduguard allows forwarding until 1st bpdu is received. then with or without bpduguard forwarding will be stopped. in bpduguard case by disabling the port, otherwise by entering LSN/LRN states. FWD then will be resumed after STP is stable again. So, I see they are different ways to handle it rather than bpduguard being more secure. So, is this correct, or I am missing something as I said? Please elaborate as I am a novice and can miss what you understand intuitively.
    – Shadi
    Jul 6, 2023 at 9:07
  • @Shadi You should really see both settings separately. portfast is pretty much a must for common use cases, but bpduguard is double edged and I wouldn't use it on all edge ports.
    – Zac67
    Jul 6, 2023 at 10:09
  • I have been reading that bpduguard is a good safeguard for portfast ports. I understand they are separate, but they are strongly related. Even the command to enable bpduguard has the portfast keyword. However, I see that portfast is capable of handling the wrong connections. so what is the real use and benefit of bpduguard?
    – Shadi
    Jul 9, 2023 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.