Lab Objective
Enable BPDU Guard globally so it automatically applies to every PortFast-enabled port, verify a connected switch triggers err-disable exactly as in the earlier PortFast lab, then separately configure BPDU Filter on a different port and observe its distinctly different, less protective behavior.
Lab Purpose
An earlier lab configured BPDU Guard per-interface. This lab shows the global configuration shortcut that automatically applies it to every PortFast port, and critically distinguishes BPDU Guard from BPDU Filter — two commands that sound similar but behave very differently, with the second carrying real risk if misunderstood.
Lab Topology
Switch1
Gi1/0/5 ---- PortFast enabled, end-user only
Gi1/0/6 ---- PortFast enabled, end-user only
(will get BPDU Filter instead)Task 1: Enable BPDU Guard Globally
Configure BPDU Guard to automatically apply to every PortFast-enabled interface, rather than configuring it individually per port.
Task 2: Enable PortFast on Both Ports
Configure PortFast on Gi1/0/5 and Gi1/0/6.
Task 3: Verify BPDU Guard Triggers on Gi1/0/5
Simulate a switch connecting to Gi1/0/5 and confirm the port becomes err-disabled, consistent with the earlier PortFast lab's behavior.
Task 4: Configure BPDU Filter on Gi1/0/6 Instead
Remove any BPDU Guard influence on Gi1/0/6 and configure BPDU Filter there instead.
Task 5: Simulate a Switch Connecting to Gi1/0/6
Connect a switch to Gi1/0/6 and observe the resulting behavior, comparing it against BPDU Guard's response.
Solution and Verification
Switch1(config)# spanning-tree portfast bpduguard default
-- Applies BPDU Guard automatically to every
-- interface with PortFast enabled, rather
-- than requiring the per-interface
-- "spanning-tree bpduguard enable" command
-- used in the earlier PortFast labSwitch1(config)# interface gigabitethernet1/0/5
Switch1(config-if)# spanning-tree portfast
Switch1(config-if)# exit
Switch1(config)# interface gigabitethernet1/0/6
Switch1(config-if)# spanning-tree portfast-- Simulated switch connects to Gi1/0/5,
-- sending BPDUs:
Switch1# show interfaces gigabitethernet1/0/5 status
Gi1/0/5 err-disabled
Switch1# show spanning-tree interface gigabitethernet1/0/5 detail
%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port
Gi1/0/5 with BPDU Guard enabled. Disabling port.
-- Identical protective behavior to the
-- earlier per-interface configuration --
-- the global command simply saved having
-- to type it on every PortFast port
-- individuallySwitch1(config)# interface gigabitethernet1/0/6
Switch1(config-if)# spanning-tree bpdufilter enable
-- If BPDU Guard's global default was
-- somehow also affecting this port, this
-- explicit filter command takes precedence
-- on this specific interface-- Simulated switch connects to Gi1/0/6,
-- sending BPDUs:
Switch1# show interfaces gigabitethernet1/0/6 status
Gi1/0/6 connected
-- The port remains UP and forwarding,
-- despite a switch (capable of causing
-- a loop) now being connected
Switch1# show spanning-tree interface gigabitethernet1/0/6
Interface Role Sts Cost
Gi1/0/6 Desg FWD 4
-- BPDU Filter does not shut the port down
-- at all -- it simply stops the switch
-- itself from sending OR processing BPDUs
-- on this port, silently ignoring the
-- rogue switch's BPDUs rather than reacting
-- to them protectivelyKey Takeaway
BPDU Guard and BPDU Filter sound similar but behave in opposite spirit: BPDU Guard actively protects the network by disabling a port the instant it detects a switch was connected where only an end device was expected, while BPDU Filter simply stops participating in BPDU exchange on that port entirely — silently disabling loop protection rather than enforcing it, which can allow an actual Layer 2 loop to form completely undetected if a switch is genuinely connected there. BPDU Filter should be used with extreme caution and only when its specific behavior is fully understood.