What is BPDU (Bridge Protocol Data Unit) Guard, how does it complement PortFast, and how do you configure it?

BPDU Guard puts a port into err-disabled state if it receives any BPDU. It's designed to work with PortFast — if a port that should only have an end device suddenly receives a BPDU (someone connected a switch), the port shuts down immediately.

* PortFast plus BPDU Guard. *

Why BPDU Guard exists:

• PortFast-enabled ports skip STP (Spanning Tree Protocol) convergence — they assume no switches are connected
• If someone connects a rogue switch to a PortFast port → spanning-tree loop risk
• BPDU Guard provides a safety net: if a BPDU arrives on a PortFast port → the port is immediately disabled

Configuration:

! Per-interface:
Switch(config)# interface Fa0/1
Switch(config-if)# spanning-tree bpduguard enable

! Globally (all PortFast-enabled ports):
Switch(config)# spanning-tree portfast bpduguard default

What happens on violation:

1. A BPDU is received on a BPDU Guard-enabled port
2. Port immediately transitions to err-disabled state
3. Console message: %SPANTREE-2-BLOCK_BPDUGUARD: BPDU Guard violation on port Fa0/1
4. Port LED turns off — no traffic flows

Recovery:

! Manual:
Switch(config-if)# shutdown
Switch(config-if)# no shutdown

! Automatic:
Switch(config)# errdisable recovery cause bpduguard
Switch(config)# errdisable recovery interval 300

Best practice: Always enable both PortFast and BPDU Guard together on access ports:

Switch(config)# spanning-tree portfast default
Switch(config)# spanning-tree portfast bpduguard default

This gives you fast access for end devices + automatic protection against rogue switches.

Verification:

Switch# show spanning-tree summary
  PortFast Default            : enabled
  PortFast BPDU Guard Default : enabled

Tip: BPDU Guard is one of the most important security features on access switches. Combined with port security and DHCP snooping, it prevents the most common Layer 2 attacks.

Go deeper:

• BPDU Guard (NetworkAcademy.IO) — why a PortFast port should never see a BPDU and the err-disable response, with config.
• Additional STP Protection Mechanisms (Cisco Press) — authoritative treatment of PortFast + BPDU Guard on host-facing ports.