Does BPDU Guard Shut the Port?

About this interactive

From the lesson: - **The spanning tree attack:** a device on an access port sends BPDUs with a very low priority and MAC to become the root bridge, pulling traffic toward itself or disrupting the network. - **PortFast** brings access ports up at once; **BPDU guard** err-disables a PortFast port the moment a BPDU arrives. An admin has to recover the port. - **Global or per port:** spanning-tree portfast bpduguard default turns it on for every PortFast port; it can also be set, or turned off, on one interface. Ports without PortFast, such as uplinks and trunks, are not covered by the global default. - End devices send no BPDUs, so normal traffic never trips it.

What you'll learn

Predict whether BPDU guard err-disables a port: a BPDU arriving on a PortFast port with BPDU guard on, per port or by the global default
Explain how PortFast with BPDU guard stops a spanning tree attack, in which a device claims to be the root bridge

Aligned to

Cisco CCNA

5.7 Configure and verify Layer 2 security features

2.5 Interpret basic operations of Rapid PVST+ Spanning Tree Protocol

Key terms

BPDU Guard: A Cisco STP security feature applied to PortFast-enabled ports that immediately shuts down the port if a BPDU is received, preventing an unauthorized switch from being connected and disrupting the spanning tree topology. It protects access-layer ports that should only connect to end devices, not other switches.
PortFast: A Cisco Spanning Tree Protocol feature applied to access-layer ports connected to end devices that allows the port to transition immediately to the forwarding state, bypassing the normal STP listening and learning phases that would otherwise delay connectivity by up to 30 seconds. PortFast should only be used on ports that connect to end devices, not to other switches.
Err-Disabled State: A Cisco switch port state where an interface is automatically shut down due to a detected error condition, such as an EtherChannel misconfiguration.
Bridge Protocol Data Unit: A data message exchanged between switches running Spanning Tree Protocol to detect network loops and elect a root bridge. BPDUs contain the sending switch's BID and path cost information used to build the loop-free spanning tree.
Root Bridge: The switch elected as the reference point for the Spanning Tree Protocol topology, determined by the switch with the lowest Bridge ID (priority + MAC address). All other switches calculate their best path to the root bridge and block redundant links to create a loop-free tree.

Topics

Bpdu Guard Portfast Stp Attack Layer 2 Security Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →