Home > Spanning-Tree > BPDU Filtering Vs BPDU Guard – What is the difference?

BPDU Filtering Vs BPDU Guard – What is the difference?

BPDU Filtering, BPDU Guard, and Root Guard are STP security mechanisms. In this post I will only describe BPDU Filtering and BPDU Guard.

These 2 features provide protection against spanning-tree loops being created on ports where PortFast has been enabled. A device attached to a PortFast interface is not supposed to send BPDUs but should this happen BPDU Filtering and BPDU Guard provide protection.

BPDU Guard and BPDU Filtering can be configured in 2 different ways, from global configuration mode or in interface configuration mode. In global configuration mode the feature (either BPDU guard or BPDU Filtering) will have effect on PortFast enabled port only. In interface configuration mode it will only affect  a specified port.

BPDU Guard

PortFast should be configured on port where bridging loops are not expected to form (which means that no BPDUs should be receive on these ports), such as on end-devices port like a single workstation or server. PortFast provides quick network access by entering directly in STP forwarding state (bypassing listning and learning state). Even if PortFast can detect a bridging loop (While PortFast is enabled on a port, STP is still running), it will detect it in a finite amount of time that is to say the length of time required to move the port through the normal STP states.

If any BPDUs  (superior to the current root or not) are received on port configured with BPDU Guard that port is put immediately in errdisable state.

If configured in global configuration mode BPDU Guard will be enable on all configured PortFast ports:

If configured in interface configuration mode it will only be enable on the specific port:

BPDU guard should be configured on all switchs ports where STP PortFast is enabled. This prevents any possibility that a switch will be added to the port  either intentionally or by mistake.

BPDU Filtering

BPDU Filtering allows to stop sending/receiving BPDUs on a port depending on how is configured.

If it is configured from global configuration mode BPDU Filtering will be enabled on all configured PortFast ports. No BPDUs will be sent out of that port which will hide STP  topology to end-users.  But as soon as a BPDU is received the port will lose  is PortFast status and  BPDU Filtering will be disabled. The port is then taking back to normal STP operation and sends/receives BPDUs. See bellow for how to configure BPDU Filtering from global configuration mode:

If BPDU Filtering is configured from the interface configuration mode the result is completely different as this will cause the specific port to stop sending AND receiving (BPDUs are dropped) BPDUs. Tthe port ignores any incoming BPDUs and changes to Forwarding state. this solution is not recommended as it can result in bridging loops.

Note: if you enable BPDU Guard on the same interface as BPDU Filtering, BPDU Guard has no effect because BPDU Filtering takes precedence over BPDU Guard. Configuation of BPDU Filtering is not a recommended configuration.

  1. Jehan Zaib Munawar
    September 6, 2012 at 18:34

    Excellent Brief

  2. Hazem Shoeib
    June 19, 2013 at 20:10

    thank you so much for making it straight understood like that.

  3. dianaa
    September 20, 2013 at 19:25

    Outstanding…. sir please correct 1 minor mistake
    But as soon as a BPDU is received the port will lose is PortFast status

    * ITS

  4. dianaa
    September 20, 2013 at 19:28

    I have started reading your every piece of word……………. amazing

  5. May 11, 2014 at 16:20

    awesome ….!!!

  6. kpriya
    March 12, 2015 at 21:01

    Great Stuff . I would like to add one more very imoprtant experince of mine. Never ever enable “bpdufilter” on etherchannel participating interface. It wil defenitely cause loop and break your network.

  7. September 23, 2015 at 16:30

    The best explanation I Found on the internet!

  8. Mike
    December 15, 2015 at 00:25

    Hi, what will be the impact if both bpdu guard and bpdu filter applied globally, whom will take precedence at the time bpdu receive

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: