BPDU guard and root guard, redundant?

Answered Question
Aug 14th, 2008
User Badges:

I've never understood why it is recommended to run BPDU guard and root guard on access ports. It seems a bit redundant to me. If you're running BPDU guard, and a superior, inferior or otherwise BPDU is received on a port, BPDU guard err-disables the port. If the port is disabled....wallah, the root bridge is protected.


Perhaps it's a best practice as a bug catch? Ergo, bug in BPDU Guard lets superior BPDU though, but BPDU Guard catches it.


Please confirm my thinking, or illustrate where it is flawed.


Thanks in advance!

Correct Answer by Francois Tallet about 8 years 11 months ago

Perfectly agree. If you have bpduguard, rootguard is irrelevant.


With rootguard, you allow the port to participate in the STP as long as it does not attempt to inject better information.


With bpduguard, you don't want the port to participate in STP at all and you errdisable it as soon as it attempts to do so.


So basically, if it's a recommendation to do both, it's a wrong recommendation;-)


Regards,

Francois

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Francois Tallet Thu, 08/14/2008 - 13:46
User Badges:
  • Gold, 750 points or more

Perfectly agree. If you have bpduguard, rootguard is irrelevant.


With rootguard, you allow the port to participate in the STP as long as it does not attempt to inject better information.


With bpduguard, you don't want the port to participate in STP at all and you errdisable it as soon as it attempts to do so.


So basically, if it's a recommendation to do both, it's a wrong recommendation;-)


Regards,

Francois

Actions

This Discussion