What Does Exactly Happen When A Switch Is Connected To A Portfast Port?

Question

I am trying to get a thorough understanding of what does happen when a switch is connected to a portfast port on another switch that is part of a stable STP network in case of:

1- the port has no bpduguard.
2- the port has the bpduguard enabled.

I know that in case 1, loops can be formed. but why? And does the port really revert to normal STP operations (LSN/LRN/FWD) as soon as it receives the first bpdu? if so, it technically prevents data forwarding as soon as it receives the 1st bpdu until FWD is reached. In this case, how is this different from bpduguard that will do the same thing (preventing forwarding) after the 1st bpdu?

And in both cases, there could be a duration of time before the 1st bpdu hits the port in question.

So, isn't the loop danger present in all cases?

I know that bpduguard has definitely much better protection by disabling the port completely. However, how is that better than reverting the port back to STP?

I looked on the Internet and even on the SE, however, nothing was clear enough or explanatory of the process in both cases (step by step) as if we are using a Wireshark. Unfortunately, I do not have a new laptop that can handle GNS3 to emulate this myself. and in Packet Tracer, no loops form at all. I guess because no real traffic.

Anyhow, I hope I will find a satisfying answer here.

Answer 1

I know that in case 1, loops can be formed

Simply connecting two switches together, by itself, does not create a loop. The problem is when portfast is enabled, the port does not participate in STP. So the ability to detect and break loops is disabled. If a loop is created, STP can't reliably detect it and break the loop.

I know that bpduguard has definitely much better protection. But Why and How?

Bpduguard will disable the port when bpdus are detected. You must manually re-enable the port.

Answer 2

So, isn't the loop danger present in all cases?

TL;DR: Yes, there is a short-term danger with portfast in any case.

With spanning tree protocol enabled, a switch port first enters the Learning state when a link comes up. In this state it already learns MAC addresses and listens to BPDUs, learning its spanning tree role, but it does not forward frames yet, in case there is a loop.

Since that often creates a problem with end nodes that expect full L2 connectivity when a link is up (think of DHCP), you can put the ports in portfast mode (admin-edge-mode on some switches).

In that mode, a port skips Learning state and enters Forwarding state right away after link up. That port still participates in spanning tree protocol but it begins forwarding frames before it actually knows its role in the spanning tree. That way, a loop may go undetected for a short period.

In a nutshell, you should use portfast/admin edge with ports towards end nodes that you don't expect to participate in a loop. Inter-switch ports and especially redundant meshing ports should never be configured for portfast.

bpduguard is also intended to be used with end-node ports, but it disables a port (=physical link down) that BDPUs are received on, either permanently until you reenable the port or for a configured period. It's used to protect against rogue switches or gross misconfiguration in your network. Disabling a port has an impact on your network availability, so it's not for every use case.

Both portfast and bpduguard may be used separately or in combination.

in case the port has no bpduguard, loops can be formed. but why?

As explained above, bpduguard protects against rogue, STP-enabled switches. xSTP cannot detect loops formed by switches/bridges that neither generate nor forward BPDUs. With portfast, an STP-enabled port skips the learning state and starts forwarding before it is able to detect a loop through STP. When it receives the first BPDUs and determines the correct port state, it stops forwarding, ending the loop.

does the port really revert to normal STP operations (LSN/LRN/FWD) as soon as it receives the first bpdu?

The port state algorithm is controlled by received BPDUs, so depending on the outcome, the port enters either state. A portfast port works like any STP-enabled port, just skipping the (safe) learning state to enable immediate forwarding after link up.