Switching · Spanning Tree

BPDU guard

Treat a BPDU on a protected endpoint attachment as a policy violation.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

Classic PVST+ is used to expose original STP behavior; rapid-PVST+ and MST are separate lessons.

Use three fresh isolated switches with Gigabit trunks: SW1 Gi1/0/23 ↔ SW2 Gi1/0/23; SW1 Gi1/0/24 ↔ SW3 Gi1/0/24; SW2 Gi1/0/24 ↔ SW3 Gi1/0/23. Both VLANs10/20 exist on every switch. Baseline SW1/SW2/SW3 priorities are4096/8192/12288, with short costs and no extra links. Start independently from the included baseline for each lesson; subsequent repair snippets apply to the named device.

Physical links are solid; device roles and relevant links are labeled.

How it works

BPDU guard enforces the expectation that a designated endpoint port should not receive bridge-control BPDUs. A received BPDU can err-disable the port regardless of whether the advertised root is superior. The interface is disabled rather than silently dropping only the control frame.

Guard can be applied directly to an interface or through a global PortFast policy on supported switches. It is separate from root guard, which rejects superior root information while allowing ordinary downstream bridging. Choose the boundary expectation first.

Configure or inspect

SW1

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 4096
spanning-tree vlan 20 priority 4096
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit

SW2

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 8192
spanning-tree vlan 20 priority 8192
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit

SW3

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 12288
spanning-tree vlan 20 priority 12288
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown

Verify the result

Illustrative output · selected lines

SW3#show interfaces status err-disabled
Port      Status       Reason
Gi1/0/1   err-disabled bpduguard
SW3#show logging
%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port GigabitEthernet1/0/1

The failure is the guard policy, not a missing VLAN. Find the unexpected bridge or reflected control traffic before recovering the endpoint port.

Failure and recovery

Repeated shutdown/no shutdown without removing the BPDU source repeats the violation. Automatic recovery settings, if used, need a deliberate operational policy and do not fix the cause.

SW3

interface GigabitEthernet1/0/1
 shutdown
 no shutdown
end
show interfaces status

Key Takeaways

Guard enforces an endpoint BPDU expectation.
Any received BPDU can trigger the policy.
Err-disable is not just BPDU dropping.
Root guard has a different boundary purpose.
Remove the cause before recovery.