Val:~$ whoami

I am Val Glinskiy, network engineer specializing in data center networks. TIME magazine selected me as Person of the Year in 2006.

Search This Blog

Wednesday, September 16, 2009

bpduguard vs. bpdufilter

Suppose you have a switch with servers connected to it. It's called "access layer switch" in Cisco lingo. There is no need to go through all spannig-tree states on these host-facing ports. So, you make port transition faster to forwarding mode with "switchport portfast" interface command. One of the benefits is that if your server boots fast, it does not need to wait until port finishes going through all STP port states and can start transmitting data immediately.
Since servers normally should ignore BPDUs coming from a switch, there is no need to send them to a server in the first place. To filter out outgoing BPDUs apply interface command "spanning-tree bpdufilter enable".
But when BPDU is received on the port with bpdufilter enabled, the port's portfast status is disabled and port will participate in spanning-tree.
 At all times network needs to be protected from unauthorized device that might decide to participate in your spanning-tree topology and cause spanning-tree loop or try to hijack STP root. Interface command "spanning-tree bpduguard enable" puts interface in err-disable mode whenever BPDU is received from connected device.
What will happen if you have both bpdufilter and bpduguard enabled on the interface?

spanning-tree portfast
spanning-tree bpdufilter enable
spanning-tree bpduguard enable
bpdufilter takes precedence and bpdugard does not work. Although bpduguard needs more administrative overhead - port needs to be enabled manually - it makes your network more secure.

1 comment:

  1. Hi,
    I enjoyed reading your post. I would just like to clarify on which platforms you saw this behaviour (filter overriding guard). In nexus terms, edge is the closest thing to portfast, and I want to highlight the fact that when port is type 'edge' and filter + guard are enabled together either both on an interface, or both globally, guard still blocks upon receiving a BPDU.