Switching · Spanning Tree

BPDU filtering

Distinguish conditional edge filtering from unconditional interface filtering.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

Classic PVST+ is used to expose original STP behavior; rapid-PVST+ and MST are separate lessons.

Use three fresh isolated switches with Gigabit trunks: SW1 Gi1/0/23 ↔ SW2 Gi1/0/23; SW1 Gi1/0/24 ↔ SW3 Gi1/0/24; SW2 Gi1/0/24 ↔ SW3 Gi1/0/23. Both VLANs10/20 exist on every switch. Baseline SW1/SW2/SW3 priorities are4096/8192/12288, with short costs and no extra links. Start independently from the included baseline for each lesson; subsequent repair snippets apply to the named device.

Physical links are solid; device roles and relevant links are labeled.

How it works

Global PortFast BPDU filtering on supporting platforms is conditional: an operational edge can stop sending after initial probes, while receiving a BPDU removes edge/filter behavior and allows ordinary STP. This differs from an interface-level bpdufilter enable, which suppresses sending and ignores received BPDUs.

Unconditional filtering can effectively remove spanning-tree protection from that link and create a loop if a bridge is attached. It is not equivalent to BPDU guard. For ordinary protected endpoint access, guard is normally the clearer fail-closed policy; special filtering requires an explicitly engineered topology.

Configure or inspect

SW1

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 4096
spanning-tree vlan 20 priority 4096
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit

SW2

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 8192
spanning-tree vlan 20 priority 8192
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit

SW3

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 12288
spanning-tree vlan 20 priority 12288
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 exit
spanning-tree portfast bpdufilter default

Verify the result

Illustrative output · selected lines

SW3#show spanning-tree summary
Portfast Default                 is disabled
PortFast BPDU Filter Default     is enabled
SW3#show running-config interface GigabitEthernet1/0/1
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast

The absence of interface-level bpdufilter enable matters: this is conditional global edge filtering. Inspect both global and interface configuration before interpreting BPDU counters.

Failure and recovery

If an unintended interface-level filter appears on a redundant uplink, isolate the risky path before removing the filter and restoring protocol participation. Do not blindly reconnect an already looping topology.

SW3

interface GigabitEthernet1/0/23
 shutdown
 no spanning-tree bpdufilter enable
 no shutdown

Key Takeaways

Global and interface filtering behave differently.
Conditional filtering depends on operational edge status.
Unconditional filtering removes BPDU-based protection.
Filtering is not BPDU guard.
Audit both global and interface settings.