Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Spanning-Tree BPDUFilter

Hi,

Is it recommended to use the Spanning-tree BPDUFilter command on an access port interface or not.

Regards

Miron

4 REPLIES
Hall of Fame Super Blue

Re: Spanning-Tree BPDUFilter

Hi Miron

If you are enabling portfast on your access ports then yes it is recommened that you should enable BPDUFilter as well as BPDUGuard.

HTH

Re: Spanning-Tree BPDUFilter

Miron,

I assume you mean bpduguard. There's a difference between bpduguard and bpdufilter. When bpduguard is enabled on a port the switch will put the port in err-disable state if it receives a bpdu on the port. Whereas, bpdufilter will stop the port from sending/receiving bpdu and that's like disabling STP on the port. Typically, bpduguard is recommended for access ports.

HTH

Sundar

New Member

Re: Spanning-Tree BPDUFilter

Hi,

I understand the advantages behind using the filter command but in the event that a device is added to the port like a hub which has the capability of introducing a loop into the network, the addition of the filter command would cause more problems than it solves?

Miron

Hall of Fame Super Blue

Re: Spanning-Tree BPDUFilter

Hi Miron

Yes, you have to be careful. Excerpt from cisco doc:-

==========================================

Enabling BPDU Filtering

When you globally enable BPDU filtering on Port Fast-enabled interfaces, it prevents interfaces that are in a Port Fast-operational state from sending or receiving BPDUs. The interfaces still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. You should globally enable BPDU filtering on a switch so that hosts connected to these interfaces do not receive BPDUs. If a BPDU is received on a Port Fast-enabled interface, the interface loses its Port Fast-operational status, and BPDU filtering is disabled.

You can also use the spanning-tree bpdufilter enable interface configuration command to enable BPDU filtering on any interface without also enabling the Port Fast feature. This command prevents the interface from sending or receiving BPDUs.

--------------------------------------------------------------------------------

Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops.

You can enable the BPDU filtering feature if your switch is running PVST+, rapid PVST+, or MSTP.

============================================

So if you have portfast turned on and the switchport receives a BPDU the port disables portfast and bpdu filtering. if it disables portfast then it will now have to go through the spanning tree calculation as far as i understand it.

Where it can be dangerous is if you enable it on a port not running port fast. This in effect turns off spanning tree on that port.

So i would only use it on port fast enabled ports.

HTH

468
Views
0
Helpful
4
Replies
CreatePlease to create content