User's Manual

Table Of Contents
248
Users Manual of CS-6306R
20.1.2.3 Configuring BPDU Guard
When you globally enable BPDU guard on ports that are Port Fast-enabled (the ports are in a Port
Fast-operational state), spanning tree shuts down Port Fast-enabled ports that receive BPDUs.
In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port
Fast-enabled port means an invalid configuration, such as the connection of an unauthorized device, and the
BPDU guard feature puts the port in the error-disabled state. When this happens, the switch shuts down the
entire port on which the violation occurred.
To prevent the port from shutting down, you can use the errdisable detect cause bpduguard shutdown
vlan global configuration command to shut down just the offending VLAN on the port where the violation
occurred.
The BPDU guard feature provides a secure response to invalid configurations because you must manually
put the port back in service. Use the BPDU guard feature in a service-provider network to prevent an access
port from participating in the spanning tree.
Follow these steps to globally enable the BPDU guard feature:
command purpose
spanning-tree portfast bpduguard Globally enables bpdu guard feature. It is
valid to all interfaces.
no spanning-tree portfast bpduguard Globally disables bpdu guard feature.
Instruction:
Globally enabling port fast feature may result in broadcast storm. The BPDU Guard or BPDU Filter should be
configured for protection sake.
Follow these steps to enable the BPDU guard feature in interface configuration mode:
Command Purpose
spanning-tree bpduguard enable Enables bpdu guard feature on the
interface.
spanning-tree bpduguard disable Disables bpdu guard feature on the
interface. It has no effect on the global
configuration.
no spanning-tree bpduguard Disables bpdu guard feature on the
interface. It has no effect on the global
configuration.