Solved: bpdu filter and port fast

carl_townshend · ‎02-17-2010

Hi all

Am I right in saying BPDU filter stops the port sending bpdu's but not receiving them? and if I enable port fast does it turn on bpdu filter or does the port in portfast mode still send/receive bpdu's ?

cheers

Kevin Dorrell · ‎02-17-2010

Enabling BPDU filter stops send and receiving BPDUs. I would strongly advise anyone never to use BPDU filter unless there is a very strong well-thought-out reason for doing so. The Spanning Tree protocol is there to protect your network against loops. If you block the BPDUs, you remove this protection.

Enabling portfast does not make any difference to sending or receiving BPDUs. Without portfast, there is a 30 second moratorium on port traffic before it goes into forwarding, just in case the attached equipment is generating BPDUs that have to be taken into account. When you enable portfast, effectively you are saying "OK, I don't think the attached equipment will generate BPDUs, so I am willing to take the risk of bringing the port up immediately. But at the same time it is best to enable bpduguard as well. That way if the attached equipment does generate a BPDU, it will kill the port stone dead before it can do too much damage to the rest of the network.

Kevin Dorrrell

Luxembourg

View solution in original post

Kevin Dorrell · ‎02-17-2010

Enabling BPDU filter stops send and receiving BPDUs. I would strongly advise anyone never to use BPDU filter unless there is a very strong well-thought-out reason for doing so. The Spanning Tree protocol is there to protect your network against loops. If you block the BPDUs, you remove this protection.

Enabling portfast does not make any difference to sending or receiving BPDUs. Without portfast, there is a 30 second moratorium on port traffic before it goes into forwarding, just in case the attached equipment is generating BPDUs that have to be taken into account. When you enable portfast, effectively you are saying "OK, I don't think the attached equipment will generate BPDUs, so I am willing to take the risk of bringing the port up immediately. But at the same time it is best to enable bpduguard as well. That way if the attached equipment does generate a BPDU, it will kill the port stone dead before it can do too much damage to the rest of the network.

Kevin Dorrrell

Luxembourg

Rick Meier · ‎02-17-2010

It would seem that Cisco has a different opinion: BPDU Filter Disabled on Access Ports Campus Manager reports a Best Practice Deviation when BPDU Filter is not enabled on access ports. Impact BPDU filtering allows you to avoid transmitting BPDUs on PortFast-enabled ports that are connected to an end system. When you enable PortFast on the switch, spanning tree places ports in the forwarding state immediately, instead of going through the listening, learning, and forwarding states. By default, spanning tree sends BPDUs from all ports regardless of whether PortFast is enabled. BDPUFilter can be enabled for each port or globally. When you enable BPDUFilter globally, it applies to all PortFast-enabled ports on the switch. When you disable PortFast on a port, the BPDU Filter that was globally enabled on the PortFast enabled port is also disabled. Fix Campus Manager provides commands for enabling BPDU Filter on access ports. To fix the Best Practice Deviation on switches using Catalyst operating system:

Kevin Dorrell · ‎02-17-2010

That's interesting. Do you have a reference to that document?

It seems dangerous to me. If you put bpdufilter on your access ports, then you could melt down the network with just a crossed cable between two access ports. This is easier to do accidentlaly than you might imagine. I could mention the user who noticed he had two RJ-45s on his IP telephone and decided to implement link redundancy by connecting both of them to access ports. Fortunately we had no bpdufilter, and we had bpduguard which shut down one of the ports. (But not before port security had stickied a few MAC addresses that had nothing to do with the ports in question, but just happened to be broadcasting at that instant. )

Kevin Dorrell

Luxembourg

tdistlists · ‎02-17-2010

Hey,

If you enable bpdu filter globally and portfast on a switchport, it will prevent that switchport from sending BPDUs. However, if that port receives a BPDU (which is really up to the whatever is connected to it) the port loses it's portfast state, disables BPDUfilter and becomes a normal STP port.

If you enable bpdu filter on a switchport directly, if I recall correctly, then that disables STP on that port -- wont send BPDUs and it will ignore inbound BPDUs.

Kevin Dorrell · ‎02-20-2010

That's interesting. So if I understand you correctly, you are saying there is a difference in behaviour between bpdu filter when set globally (and therefore implied on the portfast port) and bpdu filter when configured explicitly on the port. I'll try that out in the lab next time I get a chance.

Kevin Dorrell

Luxembourg

Kevin Dorrell · ‎02-20-2010

Well tdistlists, I tried this out in the lab, and you are absolutely right.

I put two ports into portfast and connected them with a crossed cable. Of course one of them went immediately into blocking.
I then shut them both, gave them spanning-tree bpdufilter enable, and no shut them. Instant meltdown loop. (I had a router on the VLAN to generate a b/c).
I then shut them down, no spanning-tree bpdufilter enable, but re-applied it globally, then no shut the ports. The ports came out of bpdufilter and portfast, and one of them went into blocking.

In fact, it seems that if you have bpdufilter enabled globally, the port still sends one or two BPDUs as it comes up. I guess this is done precisely to deal with this situation, where you (accidentally) connect two ports, both with "bpdufilter by default", together with a crossed cable. That initial BPDU will take the other port out of portfast and bpdufilter.

I can still think of one situation where this could be dangerous. Consider a switch with portfast on by default and bpdufilter enabled by default. It does not matter what bpduguard is. Now connect a dumb supermarket switch to each of two access ports. The two switchports are now up, and they are in portfast, and they have finished sending their initial BPDUs. Now cross connect the two dumb switches. I think that will melt down the network.

Thanks again for pointing out this behaviour.

Kevin Dorrell

Luxembourg

sidcracker · ‎02-20-2010

BPDU filtering allows you to avoid sending or recieving bpdu on a port-fast port. BPDU are sent and recieved irrespective whether the ports are port-fast enabled. This is done on a per-switch basis. This applies to all port-fast enabled ports.