Hands-On Lab: Configuring BPDU Guard and BPDU Filter

Lab Objective

Enable BPDU Guard globally so it automatically applies to every PortFast-enabled port, verify a connected switch triggers err-disable exactly as in the earlier PortFast lab, then separately configure BPDU Filter on a different port and observe its distinctly different, less protective behavior.

Lab Purpose

An earlier lab configured BPDU Guard per-interface. This lab shows the global configuration shortcut that automatically applies it to every PortFast port, and critically distinguishes BPDU Guard from BPDU Filter — two commands that sound similar but behave very differently, with the second carrying real risk if misunderstood.

Lab Topology

Switch1
  Gi1/0/5 ---- PortFast enabled, end-user only
  Gi1/0/6 ---- PortFast enabled, end-user only
               (will get BPDU Filter instead)

Task 1: Enable BPDU Guard Globally

Configure BPDU Guard to automatically apply to every PortFast-enabled interface, rather than configuring it individually per port.

Task 2: Enable PortFast on Both Ports

Configure PortFast on Gi1/0/5 and Gi1/0/6.

Task 3: Verify BPDU Guard Triggers on Gi1/0/5

Simulate a switch connecting to Gi1/0/5 and confirm the port becomes err-disabled, consistent with the earlier PortFast lab's behavior.

Task 4: Configure BPDU Filter on Gi1/0/6 Instead

Remove any BPDU Guard influence on Gi1/0/6 and configure BPDU Filter there instead.

Task 5: Simulate a Switch Connecting to Gi1/0/6

Connect a switch to Gi1/0/6 and observe the resulting behavior, comparing it against BPDU Guard's response.

Solution and Verification

Switch1(config)# spanning-tree portfast bpduguard default

-- Applies BPDU Guard automatically to every
-- interface with PortFast enabled, rather
-- than requiring the per-interface
-- "spanning-tree bpduguard enable" command
-- used in the earlier PortFast lab

Switch1(config)# interface gigabitethernet1/0/5
Switch1(config-if)# spanning-tree portfast
Switch1(config-if)# exit
Switch1(config)# interface gigabitethernet1/0/6
Switch1(config-if)# spanning-tree portfast

-- Simulated switch connects to Gi1/0/5,
-- sending BPDUs:

Switch1# show interfaces gigabitethernet1/0/5 status

Gi1/0/5    err-disabled

Switch1# show spanning-tree interface gigabitethernet1/0/5 detail

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port
Gi1/0/5 with BPDU Guard enabled. Disabling port.
-- Identical protective behavior to the
-- earlier per-interface configuration --
-- the global command simply saved having
-- to type it on every PortFast port
-- individually

Switch1(config)# interface gigabitethernet1/0/6
Switch1(config-if)# spanning-tree bpdufilter enable

-- If BPDU Guard's global default was
-- somehow also affecting this port, this
-- explicit filter command takes precedence
-- on this specific interface

-- Simulated switch connects to Gi1/0/6,
-- sending BPDUs:

Switch1# show interfaces gigabitethernet1/0/6 status

Gi1/0/6    connected
-- The port remains UP and forwarding,
-- despite a switch (capable of causing
-- a loop) now being connected

Switch1# show spanning-tree interface gigabitethernet1/0/6

Interface        Role Sts Cost
Gi1/0/6          Desg FWD 4
-- BPDU Filter does not shut the port down
-- at all -- it simply stops the switch
-- itself from sending OR processing BPDUs
-- on this port, silently ignoring the
-- rogue switch's BPDUs rather than reacting
-- to them protectively

Key Takeaway

BPDU Guard and BPDU Filter sound similar but behave in opposite spirit: BPDU Guard actively protects the network by disabling a port the instant it detects a switch was connected where only an end device was expected, while BPDU Filter simply stops participating in BPDU exchange on that port entirely — silently disabling loop protection rather than enforcing it, which can allow an actual Layer 2 loop to form completely undetected if a switch is genuinely connected there. BPDU Filter should be used with extreme caution and only when its specific behavior is fully understood.