What is BPDU Guard and how do I use it?

BPDU Guard is a security feature that shuts down a port if it receives a BPDU (Bridge Protocol Data Unit), preventing rogue switches from participating in STP.

Why It Exists

Access ports connect to end devices (PCs, phones, cameras) that shouldn't send BPDUs. If a BPDU arrives, it means someone connected a switch — potentially disrupting the STP topology or launching an attack.

Attack Scenarios Prevented

• Rogue switch attempting to become root bridge
• Attacker connecting a switch to hijack traffic patterns
• Users accidentally creating loops with cheap consumer switches

How It Works

1. Enable BPDU Guard on access ports
2. Port operates normally as long as no BPDUs received
3. If any BPDU received, port is placed in err-disabled state
4. Manual intervention (or auto-recovery timer) restores port

Configuration

Applied per-port or globally on PortFast/edge ports:

interface Gi0/1\n  spanning-tree portfast\n  spanning-tree bpduguard enable

Related Features

• BPDU Filter: Ignores BPDUs (doesn't shut down port) — use with caution
• Root Guard: Prevents port from becoming root port (used on downlinks)
• Loop Guard: Detects unidirectional links

Auto-Recovery

Configure err-disable auto-recovery for BPDU Guard events:

• Recovery timeout typically 5-10 minutes
• Allows recovery without manual intervention
• Logs indicate the cause

Best Practices

• Enable BPDU Guard on all access ports
• Use Root Guard on ports facing untrusted switches
• Combine with loop detection for comprehensive protection
• Alert NMS on BPDU Guard events (indicates policy violation)