TechKnowSurge

Cisco CCNA 2.5 Cisco CCNA 5.1 Cisco CCNA 5.7

VideoNetworkFree

BPDU Guard

Spanning Tree Protocol (STP) prevents switching loops in redundant network environments but introduces security vulnerabilities that attackers can exploit to manipulate traffic flow. This content covers how STP attacks work and how to defend against them using PortFast and BPDU Guard configuration.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Spanning Tree Protocol (STP) solves a fundamental layer-2 problem by using the Spanning Tree Algorithm to elect a root bridge and block redundant paths that would otherwise cause broadcast storms. Without STP, a single broadcast frame on a network with redundant switch links can loop indefinitely, multiplying across every connected switch and consuming bandwidth until the network becomes unusable. STP prevents this by maintaining only the lowest-cost path to the root bridge while keeping backup paths in a blocked state. Despite its value, STP introduces a exploitable attack vector known as an STP attack. An attacker who gains access to a switch port that accepts BPDU frames can transmit BPDUs with a very low priority value and MAC address, causing the network to elect the attacker's device as the new root bridge. Once elected, all other switches recalculate their paths toward the attacker, which can be leveraged to intercept traffic, launch a denial-of-service attack, or otherwise disrupt network operations. The mitigation is well-established and relatively simple to implement. Enabling PortFast on access ports allows end-user devices to connect without delay, and pairing it with BPDU Guard ensures that any BPDU received on those ports triggers an immediate shutdown of the affected port. BPDU Guard can be applied globally using the spanning-tree portfast bpduguard default command in global configuration mode, which automatically protects all PortFast-enabled ports, or it can be configured on individual interfaces as needed. With this configuration in place, any attempt by an attacker to inject BPDUs and claim root bridge status is immediately blocked at the port level, effectively eliminating STP-based attacks from the threat surface.

What you'll learn

Explain how an STP attack exploits Bridge Protocol Data Units (BPDUs) to manipulate root bridge election and disrupt network traffic
Configure PortFast and BPDU Guard on switch access ports to mitigate Spanning Tree Protocol attacks

What's covered

Spanning Tree Protocol Security

STP Overview
- Prevents Switch Loops
  - Redundant Links Problem
  - Broadcast Multiplication Risk
- Root Bridge Election
  - Spanning Tree Algorithm
  - Least Cost Path
STP Attack
- Attacker Sends BPDUs
  - Low Priority Value
  - Low MAC Address
- Attacker Becomes Root Bridge
  - Network Recalculates Paths
  - Denial of Service Risk
Mitigation with PortFast
- Faster Port Bring-Up
- Applied to Access Ports
BPDU Guard Configuration
- Global vs Per-Port Setting
  - Global Enables on PortFast Ports
- Blocks BPDUs on Access Ports
  - Port Shuts Down if BPDU Received

Aligned to

Cisco CCNA

2.5 Interpret basic operations of Rapid PVST+ Spanning Tree Protocol

5.1 Define key security concepts

5.7 Configure and verify Layer 2 security features

Key terms

Spanning Tree Protocol: A network protocol that prevents loops in Ethernet networks by creating a loop-free logical topology.
Bridge Protocol Data Unit: A data message exchanged between switches running Spanning Tree Protocol to detect network loops and elect a root bridge. BPDUs contain the sending switch's BID and path cost information used to build the loop-free spanning tree.
Root Bridge: The switch elected as the reference point for the Spanning Tree Protocol topology, determined by the switch with the lowest Bridge ID (priority + MAC address). All other switches calculate their best path to the root bridge and block redundant links to create a loop-free tree.
PortFast: A Cisco Spanning Tree Protocol feature applied to access-layer ports connected to end devices that allows the port to transition immediately to the forwarding state, bypassing the normal STP listening and learning phases that would otherwise delay connectivity by up to 30 seconds. PortFast should only be used on ports that connect to end devices, not to other switches.
BPDU Guard: A Cisco STP security feature applied to PortFast-enabled ports that immediately shuts down the port if a BPDU is received, preventing an unauthorized switch from being connected and disrupting the spanning tree topology. It protects access-layer ports that should only connect to end devices, not other switches.
Denial of Service: An attack that floods a system or network with traffic to make it unavailable to legitimate users.

Topics

Spanning Tree Protocol Bpdu Guard Network Security Switch Security Portfast Networking

Transcript

Spanning Tree Protocol is a really important protocol to make sure that we don't get switch loops within our network, but Spanning Tree Protocol does introduce its own challenges in itself. It can introduce some ability for attackers to leverage Spanning Tree Protocol to be able to carry out attacks on your network.

We'll do a quick review over what Spanning Tree Protocol is, we'll get into how that can be leveraged for a Spanning Tree Protocol attack, and then we're going to get into how to mitigate against it. It's pretty simple: you use PortFast BPDU Guard, and we'll take a look at that configuration.

A quick spanning tree review

If you didn't have Spanning Tree Protocol enabled on your network and you had redundant links, it could cause a lot of problems with switching loops. Switching loops are when there are redundant links on your network, and let's say demo laptop sends out a broadcast to switch 2. That gets sent out all the other links. Switch 1 will receive that from switch 2 and broadcast it out all its links. Switch 3 will receive that from switch 1 and broadcast it out on all its links, all of the other ports. Not only is this going to continue in this direction, but since switch 2 sent it directly to switch 3, it's going to happen in the other direction as well, and it's going to only multiply. Even just a single broadcast could continue to multiply across this network, so it's really problematic with just one broadcast — now imagine a whole network of broadcasts.

So Spanning Tree Protocol has a spanning tree algorithm that elects a root bridge, and then based off of that root bridge it finds the fastest path, or the path with the least cost, to the root bridge, and shuts down all other paths.

The spanning tree attack

Now the problem with Spanning Tree Protocol is it does have some vulnerabilities to it. What an attacker can do is carry out an STP attack, a Spanning Tree Protocol attack. All the attacker needs to do is connect to a port that accepts these bridge protocol data units — that's the communication that's used to figure out who the root bridge is — and it could send it out with a very low priority and a low MAC address to guarantee itself that it will become the root bridge.

What happens is that all of the other devices will recalculate the path towards the attacker, and the attacker can leverage this for some sort of attack, like a denial of service attack or some other type of attack. So this one's a little more tricky to carry out, but it can be done, and there are very simple ways to mitigate against this.

Mitigating with PortFast and BPDU Guard

We should just mitigate against this by implementing these security features. We should turn on PortFast with BPDU Guard. PortFast allows these ports to be brought up faster, so when a client machine connects into the network, then that port is brought up faster. But we include this BPDU Guard, and you can do that per port, or you can do it globally on the switch for any of the PortFast ports.

So if you have an access port, the recommendation is to set up PortFast on it, and then I like to turn the BPDU Guard on from a global level. That way, if that access port receives a BPDU — those frames that carry out that information, that Spanning Tree Protocol information — then it gets shut down and this device won't have connectivity to that network. It will not be able to connect to the network on that port.

We've actually already covered the configuration for this. This is showing you how, in the global configuration mode, you can do the portfast bpdu guard default. What this is doing is it's turning on BPDU Guard for any port that has PortFast turned on it. We'd like our access ports to have this turned on, so if that's turned on, then the BPDU Guard will also be in effect by default. You would have to specifically turn it off for it to not take effect on that.

And then we go into our individual interfaces — I could do a whole range of interfaces if I wanted to — and type in the spanning tree portfast, and now that will also have the BPDU Guard enabled on it, so it will be protected. Now if an attacker joins that port, connects to that port and tries to send out those BPDUs to create itself as being the root bridge, it's going to get blocked.

We did a real quick STP review, Spanning Tree Protocol review. We talked about an STP attack and what that looks like, and how it uses BPDUs to make that connection and try to be the root bridge of that network. And then we talked about PortFast, and how if you turn on PortFast with BPDU Guard, then we can block that port from receiving BPDUs and eliminate this STP attack from being problematic at all.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →