What Is a BPDU?

BPDU stands for Bridge Protocol Data Unit. STP-enabled switches use BPDUs to exchange spanning-tree information.

BPDUs help switches determine information such as:

• Root Bridge
• Spanning-tree topology
• Path information
• Port roles and topology changes

    Switch A
       |
      BPDU
       |
       v
    Switch B

 STP information
   is exchanged
   using BPDUs

What Is an Edge Port?

An edge port is a switch port intended to connect directly to an end device rather than another network switch.

Typical devices connected to edge/access ports include:

• Desktop computers
• Laptops
• Printers
• IP phones
• Cameras
• Other endpoint devices

   Switch
  +-------+
  |       |
  +---+---+
      |
    Access
     Port
      |
   +--+--+
   | PC  |
   +-----+

On Cisco switches, PortFast is commonly used on ports connected to end devices so they can transition to the forwarding state without waiting through the normal legacy STP listening and learning process.

What Is BPDU Guard?

BPDU Guard is an STP protection feature that is commonly enabled on edge/PortFast ports.

Its purpose is simple:

    Edge Port
        |
        | Expected:
        | End Device
        v
       PC


    Unexpected:
        |
        | BPDU
        v
     Switch

If a BPDU is received on a port protected by BPDU Guard, the switch treats this as an unexpected STP condition and places the interface into an error-disabled state on Cisco IOS implementations.

Why Is BPDU Guard Important?

Imagine an office where a user connects a small unmanaged or managed switch to an access port:

              Main Switch
             +-----------+
             |           |
             +-----+-----+
                   |
              Access Port
                   |
                User PC
                   |
             +-----+-----+
             | Small     |
             | Switch    |
             +-----------+
              /         \
            PC          PC

If the connected device is another switch, it can participate in STP and send BPDUs into the network.

BPDU Guard helps protect ports that were intended only for endpoint devices from unexpected BPDUs.

What Happens When BPDU Guard Receives a BPDU?

On Cisco IOS, a BPDU received on a BPDU Guard-protected interface can cause the interface to enter the err-disabled state.

   BPDU received
         |
         v
   BPDU Guard detects it
         |
         v
   Interface protected
         |
         v
   Err-disabled state

This behavior prevents the affected edge port from continuing normal forwarding.

BPDU Guard vs PortFast

These features are related but they perform different jobs.

A common design is to use PortFast and BPDU Guard together on appropriate endpoint-facing ports.

Cisco Configuration: Interface Level

Example:

```

Switch(config)# interface gigabitEthernet0/1
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable 

This configuration is appropriate when the interface is intended to connect to an endpoint and not another switch.

Enable BPDU Guard Globally

Cisco IOS also supports enabling BPDU Guard globally for interfaces operating with PortFast:

```

Switch(config)# spanning-tree portfast bpduguard default 

This provides a convenient way to apply BPDU Guard behavior to PortFast-enabled interfaces, depending on the platform and configuration.

Important Warning

BPDU Guard should not be blindly enabled on switch-to-switch trunk links or other ports where receiving BPDUs is expected.

   Switch A
       |
    Trunk Link
       |
   Switch B

   BPDUs are expected
         ↓
   Do NOT treat this
   as an endpoint port

Always understand the role of an interface before applying edge-port security features.

How to Verify BPDU Guard

Useful Cisco commands include:

```

Switch# show spanning-tree interface gigabitEthernet0/1 detail 

You can also check interface status:

```

Switch# show interfaces status 

If an interface becomes error-disabled, Cisco platforms can provide information through:

```

Switch# show interfaces status err-disabled 

What Is Err-Disabled?

Err-disabled is a Cisco switch state used when the switch has disabled an interface because of a detected condition.

Possible causes include various security and operational conditions, one of which can be BPDU Guard detecting an unexpected BPDU.

The exact recovery behavior depends on the configured platform and errdisable settings.

Practical Packet Tracer Lab

Topology

             Switch
          +---------+
          |         |
          +----+----+
               |
          Gi0/1
               |
              PC

Tasks

1. Connect a PC to a switch access port.
2. Configure the interface as an access port.
3. Enable PortFast.
4. Enable BPDU Guard.
5. Verify the configuration.
6. Replace the endpoint with another switch where your lab platform allows it.
7. Observe the effect of receiving a BPDU.

Configuration

```

Switch(config)# interface gigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable 

Quick Quiz

Question 1

What does BPDU stand for?

Question 2

Where is BPDU Guard commonly configured?

Question 3

What can happen when BPDU Guard receives a BPDU?

Question 4

Should BPDU Guard normally be enabled on a switch-to-switch trunk?

Key Takeaways

• BPDU Guard is an STP security feature.
• It is commonly used on edge/PortFast ports.
• Edge ports are normally intended for endpoint devices.
• A BPDU arriving on a protected port is treated as an unexpected condition.
• On Cisco IOS, BPDU Guard can place the interface into err-disabled state.
• PortFast and BPDU Guard solve different problems and are often used together.
• Do not blindly configure BPDU Guard on switch-to-switch links.