LogoفارسیFA

Hands-On Lab: Configuring Spanning Tree Protocol for Access Ports (PortFast)

This hands-on lab configures PortFast on an access port connecting to an end-user device, bypassing the normal listening and learning delay so the port forwards traffic immediately, and covers why PortFast should never be applied to a port connecting to another switch.

PortFast ConfigurationSTP Convergence DelayBPDU Guard

~3 min read · Updated Sep 22, 2026

Lab Objective

Configure PortFast on an access port connecting to a PC, verify the port transitions directly to forwarding without the normal listening and learning delay, and enable BPDU Guard as a safety mechanism for that same port.

Lab Purpose

A normal access port takes 30-50 seconds to reach forwarding state, as observed in an earlier lab on STP port states — this delay is unnecessary and disruptive for end-user devices like PCs, which need immediate connectivity (for DHCP requests, for example) the moment they connect. PortFast eliminates this delay specifically for ports that will never connect to another switch.

Lab Topology

Switch1 ---- Gi1/0/8 ---- PC (end-user device only,
                          never a switch or hub)

Task 1: Observe Normal STP Delay Without PortFast

Shut down and re-enable Gi1/0/8 without PortFast configured, and time how long it takes to reach the forwarding state.

Task 2: Configure PortFast

Enable PortFast on Gi1/0/8.

Task 3: Verify Immediate Forwarding

Shut down and re-enable the port again, and confirm it now reaches forwarding state immediately.

Task 4: Enable BPDU Guard as a Safety Measure

Enable BPDU Guard on the same port to automatically disable it if a switch is ever mistakenly connected there instead of a PC.

Task 5: Verify BPDU Guard Triggers Appropriately

Simulate connecting a switch to this port (by connecting a device that sends BPDUs) and confirm the port is placed into err-disabled state.

Solution and Verification

Switch1(config)# interface gigabitethernet1/0/8
Switch1(config-if)# shutdown
Switch1(config-if)# no shutdown

Switch1# show spanning-tree interface gigabitethernet1/0/8
-- checked repeatedly: BLK -> LIS -> LRN -> FWD
-- taking the normal 30-50 second delay

Switch1(config)# interface gigabitethernet1/0/8
Switch1(config-if)# spanning-tree portfast

%Warning: portfast should only be enabled on ports
connected to a single host. Connecting hubs, concentrators,
switches, bridges, etc... to this interface when portfast
is enabled, can cause temporary bridging loops.

Switch1(config-if)# shutdown
Switch1(config-if)# no shutdown

Switch1# show spanning-tree interface gigabitethernet1/0/8

Interface        Role Sts Cost
Gi1/0/8          Desg FWD 4
-- Reaches Forwarding essentially instantly,
-- skipping Listening and Learning entirely

Switch1(config-if)# spanning-tree bpduguard enable

-- After connecting a device sending BPDUs
-- to this port:

Switch1# show interfaces gigabitethernet1/0/8 status

Gi1/0/8    err-disabled

Switch1# show spanning-tree interface gigabitethernet1/0/8 detail

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port
Gi1/0/8 with BPDU Guard enabled. Disabling port.

Key Takeaway

PortFast should only ever be configured on ports connecting exclusively to end-user devices — enabling it on a port that could receive a switch connection risks creating a temporary Layer 2 loop, discussed earlier in this series, before STP has a chance to detect it. Pairing PortFast with BPDU Guard closes this gap automatically: if a switch is ever mistakenly plugged into a PortFast port, the port shuts itself down the instant a BPDU is received, rather than allowing a loop to form.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring Static Routing via IP Addresses

This hands-on lab configures static routes using a next-hop IP address rather than an outgoing interface, the generally preferred syntax, and compares the resulting routing table entry against the interface-based approach from the previous lab.

Continue

Hands-On Lab: Configuring Static Routing via Interfaces

This hands-on lab configures static routes using an outgoing interface rather than a next-hop IP address, demonstrating this approach's suitability for point-to-point links and its important limitation on multi-access networks.

Continue

Hands-On Lab: Installing a Wireless LAN Controller

This hands-on lab performs the initial setup of a Wireless LAN Controller, joins a lightweight access point to it, and creates a centrally managed WLAN, demonstrating the controller-based architecture that scales far beyond standalone access points.

Continue

Hands-On Lab: Installing a Wireless Access Point

This hands-on lab covers physically connecting and performing the initial configuration of a standalone wireless access point, including setting up an SSID, applying WPA3 security, and verifying wireless clients can associate and reach the wired network.

Continue

Hands-On Lab: Configuring and Allowing Inter-VLAN Routing — SVI

This hands-on lab configures inter-VLAN routing using Switch Virtual Interfaces on a Layer 3 switch, enabling IP routing directly on the switch itself and comparing this approach against the router-on-a-stick method from the previous lab.

Continue

Hands-On Lab: Configuring Inter-VLAN Routing (Router on a Stick)

This hands-on lab configures inter-VLAN routing using a single router interface divided into subinterfaces, connecting to a switch trunk to route traffic between two VLANs through one physical link.

Continue
Previous ArticleNext Article