Cisco Systems 3750E manual Enabling Bpdu Guard, Spanning-tree portfast trunk, Portfast, 20-13

Chapter 20 Configuring Optional Spanning-Tree Features

Configuring Optional Spanning-Tree Features

You can enable this feature if your switch is running PVST+, rapid PVST+, or MSTP.

Beginning in privileged EXEC mode, follow these steps to enable Port Fast. This procedure is optional.

	Command	Purpose
Step 1
	configure terminal	Enter global configuration mode.
Step 2
	interface interface-id	Specify an interface to configure, and enter interface
		configuration mode.
Step 3
	spanning-tree portfast [trunk]	Enable Port Fast on an access port connected to a single
		workstation or server. By specifying the trunk keyword, you can
		enable Port Fast on a trunk port.
		Note To enable Port Fast on trunk ports, you must use the
			spanning-tree portfast trunk interface configuration
			command. The spanning-tree portfast command will
			not work on trunk ports.
		Caution Make sure that there are no loops in the network
				between the trunk port and the workstation or server
				before you enable Port Fast on a trunk port.
		By default, Port Fast is disabled on all interfaces.
Step 4
	end	Return to privileged EXEC mode.
Step 5
	show spanning-tree interface interface-id	Verify your entries.
	portfast
Step 6
	copy running-config startup-config	(Optional) Save your entries in the configuration file.

Note You can use the spanning-tree portfast default global configuration command to globally enable the Port Fast feature on all nontrunking ports.

To disable the Port Fast feature, use the spanning-tree portfast disable interface configuration command.

Enabling BPDU Guard

When you globally enable BPDU guard on ports that are Port Fast-enabled (the ports are in a Port Fast-operational state), spanning tree shuts down Port Fast-enabled ports that receive BPDUs.

In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port means an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the port in the error-disabled state. When this happens, the switch shuts down the entire port on which the violation occurred.

To prevent the port from shutting down, you can use the errdisable detect cause bpduguard shutdown vlan global configuration command to shut down just the offending VLAN on the port where the violation occurred.

	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02		20-13