The port that must never see another switch

BPDU guard shuts a port down the moment it receives a spanning tree message, because a desk port should never hear one.

Hone is a place to practise programming. This is one of its lessons, written out in full and free to read without an account.

What it is for

Somebody plugs a cheap switch or a looped patch lead into a desk port, and the whole network suffers. BPDU guard turns that into one dead port instead.

How to think about it

Put it on every access port that has portfast. The pair belongs together: portfast says 'there is one host here', BPDU guard enforces it.

Worked example

enable

The # prompt.

configure terminal

Into configuration mode.

interface gi0/4

The desk port.

switchport mode access

Access.

spanning-tree portfast

No wait, because there is one host here.

spanning-tree bpduguard enable

And if that turns out to be false, the port goes down rather than the network.

end

Out.

show running-config

Both lines under the interface. This pair is what an access port should look like on a network anybody can reach.

Your turn

Shut this port if it ever hears a spanning tree message.

spanning-tree bpduguard

The trap

Putting it on an uplink. Uplinks are supposed to receive spanning tree messages, so BPDU guard there disables the link to the rest of the building the moment it comes up.

Practise BPDU guard on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.