Enabling Bpdu Guard - Cisco IE 3000 Software Configuration Manual
Hide thumbs
Also See for IE 3000:
- Hardware installation manual (186 pages) ,
- Getting started manual (32 pages) ,
- Software configuration manual (874 pages)
Table of Contents
Advertisement
Chapter 18
Configuring Optional Spanning-Tree Features
You can use the spanning-tree portfast default global configuration command to globally enable the
Note
Port Fast feature on all nontrunking ports.
To disable the Port Fast feature, use the spanning-tree portfast disable interface configuration
command.
Enabling BPDU Guard
When you globally enable BPDU guard on ports that are Port Fast-enabled (the ports are in a Port
Fast-operational state), spanning tree continues to run on the ports. They remain up unless they receive
a BPDU.
In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port
Fast-enabled port means an invalid configuration, such as the connection of an unauthorized device, and
the BPDU guard feature puts the port in the error-disabled state. When this happens, the switch shuts
down the entire port on which the violation occurred.
To prevent the port from shutting down, you can use the errdisable detect cause bpduguard shutdown
vlan global configuration command to shut down just the offending VLAN on the port where the
violation occurred.
The BPDU guard feature provides a secure response to invalid configurations because you must
manually put the port back in service. Use the BPDU guard feature in a service-provider network to
prevent an access port from participating in the spanning tree.
Configure Port Fast only on ports that connect to end stations; otherwise, an accidental topology loop
Caution
could cause a data packet loop and disrupt switch and network operation.
You also can use the spanning-tree bpduguard enable interface configuration command to enable
BPDU guard on any port without also enabling the Port Fast feature. When the port receives a BPDU, it
is put it in the error-disabled state.
You can enable the BPDU guard feature if your switch is running PVST+, rapid PVST+, or MSTP.
Beginning in privileged EXEC mode, follow these steps to globally enable the BPDU guard feature. This
procedure is optional.
Command
Step 1
configure terminal
Step 2
spanning-tree portfast bpduguard default
Step 3
interface interface-id
Step 4
spanning-tree portfast
Step 5
end
Step 6
show running-config
Step 7
copy running-config startup-config
OL-13018-01
Purpose
Enter global configuration mode.
Globally enable BPDU guard.
By default, BPDU guard is disabled.
Specify the interface connected to an end station, and enter
interface configuration mode.
Enable the Port Fast feature.
Return to privileged EXEC mode.
Verify your entries.
(Optional) Save your entries in the configuration file.
Cisco IE 3000 Switch Software Configuration Guide
Configuring Optional Spanning-Tree Features
18-11
Advertisement
Chapters
Table of Contents
Troubleshooting
