PlantUML DiagramAccess Port with PortFast and BPDU Guard
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
This is the output of a healthy STP configuration. `protocol rstp` confirms Rapid PVST+ is running. Bridge ID priority 4096 + VLAN 10 = 4106. Every port is Desg/FWD — this switch is the root for VLAN 10 and all its ports are forwarding.
! Set STP mode (verify yours isn't classic)SW1(config)# spanning-tree mode rapid-pvst! Configure root for specific VLANsSW1(config)# spanning-tree vlan 10 priority 4096SW1(config)# spanning-tree vlan 20 priority 4096! Root secondary for backup VLANs on the same switchSW1(config)# spanning-tree vlan 30 priority 8192SW1(config)# spanning-tree vlan 40 priority 8192! Enable PortFast and BPDU Guard globally on access portsSW1(config)# spanning-tree portfast defaultSW1(config)# spanning-tree portfast bpduguard default
That's the backbone of any STP configuration. Set the mode, set priorities to control root election, and enable PortFast + BPDU Guard as global defaults for access ports. The last two are the ones that save you when someone plugs a switch into a wall jack.
PortFast tells the switch to skip Listening and Learning on access ports — they go straight to Forwarding. This is safe because access ports connect to endpoints (PCs, phones) that don't participate in STP. It saves the 30-second wait when a PC boots.
BPDU Guard watches for BPDUs on those same PortFast ports. If a BPDU arrives — meaning something switch-like is connected — BPDU Guard immediately err-disables the port. This stops accidental loops cold: someone plugs a consumer switch into a wall jack, BPDU Guard catches it, the port shuts down, and the network stays healthy.
BPDU Guard and PortFast should always be enabled together on user-facing access ports. PortFast alone speeds up boot but leaves you exposed to accidental loop injection. BPDU Guard alone isn't as useful because there's nothing to speed up. Together they make the port safe and fast.
| Feature | Protects against | Where to apply |
|---|---|---|
| BPDU Guard | Accidental switch insertion on access ports | PortFast access ports |
| Root Guard | A rogue switch becoming root via a better priority | Non-designated ports facing downstream switches |
| Loop Guard | One-way link failures that cause loops in a blocked port | Root and alternate ports on trunks |
| UDLD | Unidirectional fiber failures | Fiber uplinks |
Loop Guard deserves special mention. If a blocked port stops receiving BPDUs because of a one-way link failure, classic STP would eventually move that port to Forwarding — causing a loop. Loop Guard detects the missing BPDUs and keeps the port blocked. RSTP has a variant called Bridge Assurance that does the same thing.
Both `portfast mode` and `Bpdu guard is enabled` are visible. `BPDU: sent 53, received 0` — the port has been sending BPDUs but never received one, which is normal for an access port with no switch connected.
STP config comes down to four things: correct mode, deliberate root priorities, PortFast on access ports, and BPDU Guard as the safety net. Verify with `show spanning-tree` and `show spanning-tree interface detail`. Next lesson covers STP failure scenarios — the troubleshooting side.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.