PortFast, BPDU Guard, Root Guard, and Loop Guard

PortFast lets an access port skip the spanning-tree transition delay and begin forwarding the instant the link comes up, which is what a workstation needs so its DHCP request and login traffic are not dropped for 30 seconds. PortFast does not disable spanning tree on that port. The port still sends and processes BPDUs (bridge protocol data units), and receiving one costs the port its edge status. BPDU guard is the companion feature that turns that event into an immediate shutdown instead of a quiet fallback.

PortFast

Configure it on the interface facing a single host, or set it as the default for every access port on the switch:

SW1(config)# interface GigabitEthernet1/0/5
SW1(config-if)# spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface when portfast is enabled, can cause temporary bridging loops.

SW1(config)# spanning-tree portfast default

Recent IOS-XE releases spell the interface command spanning-tree portfast edge, and the two forms mean the same thing. A separate spanning-tree portfast trunk form exists for trunk ports facing a server or a hypervisor, and it should never be pointed at another switch. The global default form applies only to ports that are operational access ports. Access point ports are the other everyday edge case, and whether one should be an access port or a trunk is settled in wiring a Cisco access point’s switchport.

What PortFast does not do:

• It does not turn spanning tree off. The port participates fully and can still be blocked.
• It does not assign or force a port role. Roles are always the result of comparing BPDUs.
• It does not change the port cost. Cost is changed with spanning-tree cost on the interface.

Beyond the speed gain, an edge port does not generate a topology change when it goes up or down, so a floor full of workstations rebooting does not flush MAC address tables across the campus.

BPDU guard

BPDU guard applies the assumption that a PortFast port faces a host, and enforces it. Any BPDU arriving on a protected port is treated as proof that something other than a host is attached, and the switch puts the interface into the err-disabled state and logs it:

SW1(config)# interface GigabitEthernet1/0/5
SW1(config-if)# spanning-tree bpduguard enable

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port GigabitEthernet1/0/5
 with BPDU Guard enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/5, putting Gi1/0/5
 in err-disable state

The per-interface form takes an explicit enable or disable keyword and overrides the global setting either way, which is why it is the right answer when a port must be protected regardless of how the switch is configured globally. The global form is spanning-tree portfast bpduguard default, and it protects only ports that are currently operational PortFast ports.

An err-disabled port stays down until someone intervenes. That is deliberate: it forces a human to find out what was plugged in. Recovery is either manual or timed:

SW1(config)# interface GigabitEthernet1/0/5
SW1(config-if)# shutdown
SW1(config-if)# no shutdown

SW1(config)# errdisable recovery cause bpduguard
SW1(config)# errdisable recovery interval 300

show interfaces status err-disabled lists what is down and why, and show errdisable recovery shows which causes are set to auto-recover and the current timer, which defaults to 300 seconds. The err-disabled value sits alongside connected, notconnect, and disabled in the port status output explained in reading interface status and counters.

The five features side by side

Feature	Applied to	Trigger	Action	Recovery
PortFast	Access ports facing one host	Link comes up	Skip to forwarding immediately	Loses edge status on receiving a BPDU
BPDU guard	PortFast ports	Any BPDU received	Err-disable the port	Manual, or errdisable recovery cause bpduguard
BPDU filter	Any port (dangerous)	Configured	Stop sending and ignore received BPDUs	None; the port never reacts
Root guard	Designated ports facing another switch	Superior BPDU received	Root-inconsistent (blocked)	Automatic when superior BPDUs stop
Loop guard	Root and alternate ports	BPDUs stop arriving	Loop-inconsistent (blocked)	Automatic when BPDUs return

BPDU filter and why it is dangerous

spanning-tree bpdufilter enable on an interface stops the port from sending BPDUs and makes it discard the ones it receives. The result is a switch port with no spanning tree at all. Plug a switch into it, or bridge two of those ports together through anything, and there is no protocol left to detect the loop. A broadcast storm follows and takes the VLAN with it.

The global form, spanning-tree portfast bpdufilter default, behaves differently and is the safer of the two. A port under the global default sends a small number of BPDUs when the link comes up, and if it hears one back it loses PortFast status and filtering and returns to normal operation. The interface form has no such safety valve.

BPDU guard and BPDU filter on the same interface do not add protection. The filter discards the BPDU before the guard can react, so the guard never fires.

Root guard

Root guard protects the position of your root bridge. It is applied to designated ports that face downstream switches, typically distribution ports pointing at access closets, or any port facing a network segment you do not administer:

SW1(config)# interface GigabitEthernet1/0/20
SW1(config-if)# spanning-tree guard root

If a superior BPDU arrives, meaning one advertising a better bridge ID than the current root, the port moves to root-inconsistent state and stops forwarding for that VLAN. The port is not err-disabled and needs no manual attention: when the superior BPDUs stop, it returns to forwarding on its own. The reasoning behind “superior” is the bridge ID comparison described in STP root bridge election.

Loop guard

Loop guard addresses the opposite failure. A root port or alternate port that suddenly stops receiving BPDUs, usually because a fiber pair has gone unidirectional or a neighbor has a software fault, would normally age out its stored information and transition to forwarding, creating a loop. Loop guard puts the port into loop-inconsistent state instead:

SW1(config)# interface GigabitEthernet1/0/26
SW1(config-if)# spanning-tree guard loop

SW1(config)# spanning-tree loopguard default

Recovery is automatic once BPDUs resume. Root guard and loop guard are mutually exclusive on one interface, because the spanning-tree guard command takes one keyword and they protect ports in different roles.

Verification

• show spanning-tree interface GigabitEthernet1/0/5 detail reports whether the port is an edge port and which guards are active.
• show spanning-tree summary reports the global PortFast, BPDU guard, BPDU filter, and loop guard defaults in one screen.
• show spanning-tree inconsistentports lists ports blocked by root guard or loop guard.
• show interfaces status err-disabled lists err-disabled ports and the reason.

How the 200-301 exam tests this

• Rogue switch on an access port. A scenario has someone plugging an unmanaged switch or a small home router into a protected port and asks what happens. The port is err-disabled and logged, and it stays down until a manual bounce or a configured recovery timer brings it back.
• PortFast misconceptions. A question asks what PortFast accomplishes, with distractors claiming it disables spanning tree, forces a role, or alters cost. It only skips the listening and learning delay for a host-facing port.
• Command placement. Answer choices scramble mode and syntax: the per-interface guard command with an enable keyword, the global portfast bpduguard default form, an invented guard bpdu keyword, and the global command pasted under an interface. The guard keyword is only ever followed by root or loop.
• Choosing the right protection. A scenario describes either a downstream switch that might advertise a better bridge ID, which calls for root guard, or a fiber link where BPDUs stopped arriving in one direction, which calls for loop guard.

Guard selection is a vocabulary problem more than a concept problem, and CCNA practice questions sort the keywords out quickly.

Quick reference

• PortFast skips the transition delay on host-facing ports; the port keeps running spanning tree and loses edge status on any received BPDU.
• spanning-tree bpduguard enable on the interface overrides the global default in both directions.
• BPDU guard err-disables the port and logs it; recovery is manual by default or automatic via errdisable recovery cause bpduguard, whose interval defaults to 300 seconds.
• Interface-level BPDU filter removes spanning tree from the port entirely and invites loops; the global form is safer because the port recovers when it hears a BPDU.
• Root guard goes on designated ports facing other switches and blocks on a superior BPDU, recovering automatically.
• Loop guard goes on root and alternate ports and blocks when expected BPDUs stop, recovering automatically.
• Root guard and loop guard cannot both be configured on the same interface.
• Edge ports and link types are covered further in Rapid PVST+ explained.