Thank you for your reply. I'm aware of storm-control for bcst/mcast/ucast. We have been asked to allow a customer owned and maintained switch to be connected to our switch (we are providing a isolated vlan for the customer, but they need more ports). The interface is in access mode, on the isolated vlan .

We have spanning-tree bpduguard enabled globally, so of course the port errdisabled when the coam switch was connected when bpdu's arrived. So we will disable portfast on that port. Plus I suggest at a minimum;

spanning-tree guard root

switchport access vlan xxx

switchport nonegotiate

no cdp enable

While putting together some info on the stp guard root I thought I'd seen something about errdisable/?? when input and/or output error counters were high. I'll reread the sections tomorrow.

Actually, malformed frames are tossed aren't they?

We were wanting to be sure we protected our device from customer induced issues.

Jph

As you can see by my other reply, the stp bpdu guard did it's job when the customer switches bdpdu's arrived on the interface.

I reviewed errdisable and I understand it takes effect by default for other features when enabled (bdduguard, link-flap, security-violation, etc).

We will allow the customer switch to be connected to ours for the time being. I was wanting to mitigate customer induced problems/mis-configs/ect from effecting our box.

Thanks Edison.

Jay