Fluke 111: The Role of Bpdu Guard in Spanning Tree

Bpduguard

As a Ccna / Ccnp candidate you are predicted to understand the purpose and function of Spanning-tree Bpdu guard. The Ccna / Ccnp's exam will ask of you to rule the purpose of the Bpduguard (Bridge Protocol Data Unit) within the spanning-tree protocol.

Fluke

Before we go into detail as to the purpose of the Bpdu Guard highlight a quick recap on the spanning-tree protocol is required.

Spanning-tree is a protocol which is designed to prevent corporal and/or logical loops in your layer 2 network. Spanning-tree achieves this loop free environment by first of all electing a gismo to act as the focal point of the network which all other switches measure themselves from. This focal point role is an elected role. The choosing of the focal point known as the "Root Bridge" is done at the very start of spanning-tree determining the loop free topology, the choosing of the Root Bridge is carried out by using a aggregate of the switches Mac address and a value known as the "Default Priority".

These two values are conveyed into the network via Bpdu's. Bpdu's are used by spanning-tree to sound a carport state network. In appropriate 802.1D spanning-tree for instance only the Root Bridge generated a Bpdu.

The stability of the Root Bridge is of paramount significance in the doing and continual uninterrupted aid of spanning-tree. A convert in the position of the Root Bridge will cause aid disruption on the network with data and voice session timing out.

It is important to reconsider what events could cause a convert in the position of the Root Bridge, events such as links failing in the middle of the existing Root Bridge and the rest of the network would cause a change, or perhaps a duplex mismatch in the middle of the Root Bridge and downstream switches causing the spanning-tree messages from the Root Bridge from reaching the other parts of the network. These events are in effect fixed and resolved none of which would need the use of the Bpdu Guard feature.

In our network we want to inflict the Spanning-tree domain borders and keep our active topology and the position of our Root Bridge predictable.

In our network we enable Bpdu Guard only on passage ports (access ports lead to end user devices) so that any end user devices on these ports that have Bpdu Guard enabled are not able to work on the Spanning-tree topology.

Bpdu Guard is enabled on an passage port:

Swith(config-if)#spanning-tree bpduguard enable

Once Bpdu Guard is enabled it will keep an eye open for any Bpdu's entering the passage ports. The only devices which can reliably originate and send Bpdu's are switches.

We want to keep a predictable topology and not allow other switches surface our operate onto our network. If a rogue switch is introduced into our topology it will in most cases send a Bpdu, if the rogue switch has "better" values than the existing Root Bridge it will cause a topology convert in the switched network. Any topology convert is bad news for the users.

By configuring the "Bpdu Guard" highlight on the access-ports enables the spanning-tree protocol to shut the port down in the event that is receives a Bpdu. As a rule of thumb, Bpdu's are in effect only predicted over trunk links.

If a rogue switch is plugged into a port configured for Bpdu Guard, the port will disable as soon as the first Bpdu is received, by shutting the port down we prevent the rogue switch from affecting our spanning-tree topology.

To re-enable a port disabled by Bdpu Guard you will need to take off the offending gismo and then bounce the port by issuing the shut/no shut command.

The Role of Bpdu Guard in Spanning Tree