BPDU Guard is one of multiple security mechanisms available in spanning tree to protect your spanning tree
network.
This could be something as simple as a user connecting a cheap consumer switch to your network that doesn't
support spanning tree and hence causing a loop or something malicious such as an attacker plugging in
a switch and making that switch
the root of the spanning tree so that the attacker can analyze your network traffic that traverses that
switch or it could be an attacker simply connecting a switch to your topology.
Lowering the priority and degrading the performance of your network considerably by forcing the network
traffic to go through a low performance switch.
So one of the options you have to stop this is BPDU Guard which will disable a port if any BPDU user received
on that port.
This is useful on ports that are going to be used as access ports and that should never be connected
to another switch.
In other words ports that are gonna be configured as portfast ports.
There are two ways to configure BPDU Guard.
You can either do it on a per-interface basis or configure it globally on a switch on a per-port basis
you would type spanning tree portfast and then spanning tree BPDU Guard enable or globally on the switch
you can use the command spanning tree portfast default. So in this topology let's assume that this hubs shouldn't
be connected to the network
and will enable BPDU Guard on switch 2 and switch 3 because we shouldn't be receiving BPDUs on any of these
ports, these ports should be connected to user PCs rather than a hub.
So conf t spanning tree portfast edge BPDU
guard, we have globally enabled BPDu Guard on switch 2. At the moment port gigabit
01 is not enabled for Portfast and we can see that by using the command show spanning tree interface
interface gigabit 01 portfast. So it's disabled but now in gigabit 01 let's type spanning tree port
fast
notice very quickly BPDU Guard warns us that a BPDU was received on these port and the port has been
disabled. So BPDU Guard error detected on this port, port is placed in the error, disabled state port has gone
down. So show interface
Gigabit 01 interfaces down line protocol is down because the port was error disabled.
Show spanning tree,
notice the port is not shown in the output here.
If we look at gigabit 01 portfast we can see that no spanning tree information is available in this port
because the port has been error disabled, shows spanning tree inconsistent ports
show spanning tree summary, we can see that the switch is using rapid previous t and we can see that
portfast edge BPDU Guard default is enabled.
So I'll shut that port down and then no shut it,
and let's see what happens again, so no shut it notice immediately
the port is error disabled. So do show run interface
Gigabit 01 we need to remove this portfast command.
So no spanning tree portfast
and do show run interface gigabit 01.
We've now removed porfast. So shut the port down
and no shut it.
Notice the port has come up, show spanning tree blocked ports gigabit 01 one is now being blocked because
that port is an alternate port on this segment the designated port is gigabit 01 on switch
3 and we can see that by typing show spanning tree, notice gigabit 01 is the designated port
on the segment,
this is a hub.
Please note.
So this is the designated port for this segment.
This port gigabit 01 is blocking on switch 2.
So these ports should have been connected to PCs but if a user connected a hub with someone trying to
do something malicious, BPDU Guard block supports immediately.
Now we can configure this on a per port basis.
So let's do that on gigabit
02. spanning tree. BPDU,
Guard, enable
notice immediately a BPDU was received on the port. Port goes to the disable mode.
So if you enable it on an interface the port doesn't even need to be configured as a portfast port.
When a BPDUs received on the port
it immediately error disables.
So do show interface
Gigabit 02, notice the port is down.
It's error disabled.