BPDU-guard - granularity is physical interface, not subinterface?

Unanswered Question
Aug 15th, 2009

If I have .1q can I configure subinterfaces with bpdu-guard so I one VLAN receives a BPDU and the other doesn't, only the subinterface which received the BPDU is SHUT, not the whole physical interface?

Thanks, MH

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Lucien Avramov Sat, 08/15/2009 - 10:09

If you have BPDU gard on a subinterface, only the subinterface will be shut.

If BPDU guard is on a physical interface that has no subinterfaces, the physical interface will be shut.

Peter Paluch Sat, 08/15/2009 - 13:18


Please correct me if I am wrong, but I have always seen the BPDU Guard implemented only on switches, and it is not possible to create subinterfaces on switchports. I wonder under what circumstances would a subinterface be considered a switchport with available BPDU Guard setting.

Any idea is appreciated!

Best regards,


mheuzenroeder Sat, 08/15/2009 - 17:21

Hi Peter,

Excellent point.

Currently I have an Access switchport with bpdu-guard on it with an SVI on this VLAN.

This is on a C6509.

I'll be changing this Access switchport to an 802.1Q trunk. It will have 2 VLANs on it each with an SVI associated with them.

You're right, there are no subinterfaces (my mistake).

I imagine the bpdu-guard can only be applied to the trunk interface and not to SVI and not to individual VLANs - right?

Hence a BPDU seen on any VLAN, including the Native VLAN, will shut the trunk port down thus affecting all VLANs - right?

I'd rather it only affect the VLAN the bpdu was received on - not sure if this is possible or how to achieve this.

Thanks for your help so far, MH

Mohamed Sobair Sat, 08/15/2009 - 22:43


I think Peter means is that layer-3 ports doesnt exchange BPDUs, However, you could have Bpdu-guard on subinterfaces if thoses sub-interfaces are part Of (Integrated routing Bridging) IRB , in other words if the sub interfaces are bridged.

Coming to the (Bpdu-guard), The recommended approach is to have BPDU-Guard configured on Access ports with spanning-tree port-fast, this is a securty feature as well as prevents from spanning-tree loop because as soon as the port recieves BPDUs , it will be shutted down.

I havent seen BPDU guard enabled on trunk ports or recommended to do so (Cisco doesnt recommend or mentioned that in thier documenatation). and the other fact that, BPDU-Guard feature is not configurable per vlan so you cant predict it from being recieved by other vlans.

Pls rate if it helps,




This Discussion