11-3
Cisco Systems IntelligentGigabit Ethernet Switch Modules for the IBM BladeCenter, Software Configuration Guide
24R9746
Chapter11 Configuring Optiona l Spanning-Tree Features
Understanding Optional Spanning-Tree Features
Understanding BPDU Guard
The BPDU guard feature can be globally enabled on the switch or can be enabled per interface, but the
feature operates with some differences.
Caution You should use the BPDU guard feature only when one switch is deployed in the chassis. If two or more
switches are in the chassis, do not enable the BPDU guard feature on the switches, either globally on
each switch or on the individual management-module ports (ports 15 a nd 16) on the switches. This
feature can put the management-module ports in the error-disabled state. The error-disabled state will
shut down the management-module ports, causing a loss of communication with the switches.
At the global level, you can enable BPDU guard on Port Fast-enabled ports by using the spanning-tree
portfast bpduguard default global configuration command. Spanning tree shuts down ports that are in
a Port Fast-operational state if any BPDU is received on those interfaces. In a valid configuration, Port
Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port signal s an
invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature
puts the port in the error-disabled state.
At the interface level, you can enable BPDU guard on any port by using the spanning-tree bpduguard
enable interface configuration command without also enabling the Port Fast feature. When the port
receives a BPDU, it is put in the error-disabled state.
The BPDU guard feature provides a secure response to invalid configurations because you must
manually put the port back in service. Use the BPDU guard feature in a service-provider network t o
prevent an access port from participating in the spanning tree.
You can enable the BPDU guard feature for the entire switch or for an interface.
Understanding BPDU Filtering
The BPDU filtering feature can be globally enabled on the switch or can be enabled per interface, but
the feature operates with some differences.
At the global level, you can enable BPDU filtering on Port Fast-enabled ports by using the
spanning-tree portfast bpdufilter default global configuration command. This command prevents
ports that are in a Port Fast-operational state from sending or receiving BPDUs. The ports still send a
few BPDUs at link-up before the switch begins to filter outbound BPDUs. You should globally enable
BPDU filtering on a switch so that hosts connected to these ports do not receive BPDUs. If a BPDU is
received on a Port Fast-enabled port, the port loses its Port Fast-operational status, and BPDU filtering
is disabled.
At the interface level, you can enable BPDU filtering on any port without also enabling the Port Fast
feature by using the spanning-tree bpdufilter enable interface configuration command. This command
prevents the port from sending or receiving BPDUs.
Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in
spanning-tree loops.
You can enable the BPDU filtering feature for the entire switch or for an interface.