DEMO: BPDU Filter

A BPDU filter essentially turns off STP on a port, which obviously is not a great thing. What we want to do is avoid using this, but there might be certain scenarios where we would want to use it.

BPDU guard versus BPDU filter

One of the questions that comes up is what is the difference between a BPDU guard and a BPDU filter. They serve very different purposes. A BPDU guard really is to prevent switching loops, and so it helps protect your network from these switching loops, versus a BPDU filter actually opens up more possibilities that these switching loops are going to occur.

So what does that look like? A BPDU guard is really designed so that way we can use the port fast command, so we can actually bring up a port faster if it's an access port, giving network services to that client faster. But the problem is it opens up a problem if somebody does plug in some sort of switch and creates a loop within your network — that can be a problem. So BPDU guard helps protect against that loop from being created, by monitoring that and seeing if it receives a BPDU. If it does receive that, then what it will do is it will go into a disabled port state, and that disabled port state then will stop all traffic from happening on that port. It has to have some sort of manual intervention — we actually have to go and shut down the port and bring it back up in order for it to work.

Versus, a BPDU filter essentially turns off spanning tree protocol on that port. Since this is turning off STP on a port, there's really no violation that can occur here.

When you would use it

I've looked for some scenarios on the internet on when you would want to use BPDU filtering, and I haven't found any great scenarios. I've only come up with one scenario where this might be used.

I was subscribed to an internet service provider once that had a switch inside our building, and it was connected to a fiber loop, so it went out to other switches. It was a whole layer 2 switching network and it was a loop, so it was a self-healing loop. Then we had our switch that was connected into their switch, which was then connected into a firewall and then our core switch right here. I did this so I had some ability to connect things to the outside world right here.

They only presented me with one connection in our demarc, in the location of our demarcation location, so there wasn't really an opportunity for me to create multiple links over to the switch. So the chances of a loop were very low. In this scenario right here, they might not want any BPDUs to go across to my switch, back and forth to the switch, and so they may filter out those BPDU messages. That way we can connect to these devices, but this switch wouldn't participate at all in the spanning tree protocol that's happening on their side of their network. So that might be an example of where this would be used.

The commands

Let's go over the commands that we would use to enable BPDU filtering. Here I am on my switch, and the first thing I need to do is get into the global configuration mode and get into an interface. So I'm going to type in to get into the global configuration mode, and then look at one of my interfaces. I'm going to do the one — let's do 1 034. And then my command that I'll use is spanning tree bpdu filter enable. So that's the command to enable it, as simple as that.