Guarding Against Rogue STP Root Bridges
BPDU filtering configuration commands

BPDU Filtering Applied Globally versus Per-Port
BPDU filtering can be configured globally or in individual PortFast enabled ports.

When enabled globally, it has these attributes:

  • It affects all operational PortFast ports on a switch that do not have BPDU filtering configured on the individual port.
  • If BPDUs are seen, the port looses its PortFast Status, BPDU filtering is disabled and STP sends and receives BPDUs on the port as any other STP port on the switch.
  • Upon startup, the port transmits ten BPDUs. If this port receives any BPDUs during that time, PortFast and PortFast BPDU filtering are disabled.

When enabled on an individual port, it has these attributes:

  • Ignores all BPDUs received
  • Sends no BPDUs
CAUTION:

Explicit configuration of PortFast BPDU Filtering on a port not connected to a host station can result in bridging loops. The port ignores any incoming BPDU and changes to the forwarding state. This does not occur when PortFast BPDU filtering is enabled globally.

The BPDU Filtering Results table lists the possible combinations that result from configuring BPDU filtering globally and on individual ports and on the same switch.

Configuring BPDU Filtering
To enable PortFast BPDU filtering globally on the switch, enter this command:

Switch(config)#spanning-tree portfast bpdufilter default

To enable PortFast BPDU filtering on a specific switch port, enter this command:

Switch(config-if)#spanning-tree bpdufilter enable

Verifying BPDU Filtering
To verify the configuration on the switch, enter this command:

Switch#show spanning-tree summary totals

To verify the configuration on a specific port, enter the command to see the associated output.