By default, ports connected to end-user devices (PCs, printers) send BPDUs as part of the Spanning Tree Protocol (STP) process.
Figure 1 – Switches send BPDUs every 2 seconds by default
However, in most cases, sending BPDUs on these ports is unnecessary and can expose sensitive STP topology information.
BPDU Filter is an STP feature that disables sending and receiving of BPDUs on ports, enhancing security and preventing unwanted BPDU exchanges.
Figure 2 – BPDU Filter blocks both sending and receiving of BPDUs
Real-World Use Case
BPDU Filter is especially useful in scenarios like company mergers, where two networks with separate STP topologies are interconnected.
BPDU Filter ensures that BPDUs are not exchanged between the different STP topologies, preserving their independent spanning tree configurations.
Figure 3 – BPDU Filter prevents STP topology exchanges between two networks
This ensures that each network maintains its own spanning tree configuration without sharing or disrupting the other’s topology.
Answer the question below
What does BPDU Filter block on a port?
BPDU Filter can be configured in two ways:
On Individual Ports: Apply to specific interfaces for precise control over which ports should stop sending BPDUs.
Globally: Enable across all PortFast-enabled ports on the switch.
Enabling BPDU Filter on Individual Ports
Let’s configure it on interface GigabitEthernet0/0 of switches SW3 and SW5 to prevent the exchange of BPDUs between two separate STP topologies.
Figure 4 – STP Topology Used to Configure BPDU Filter
Configuring BPDU Filter on SW3
Enable BPDU Filter on the interface:
SW3# conf t Enter configuration commands, one per line. End with CNTL/Z. SW3(config)# interface g0/0 SW3(config-if)# spanning-tree bpdufilter enable SW3(config-if)# endVerify the configuration:
SW3# show spanning-tree interface g0/0 detail Port 1 (GigabitEthernet0/0) of VLAN0001 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.1. Designated root has priority 32769, address 5030.9804.6800 Designated bridge has priority 32769, address 5030.9804.6800 Designated port id is 128.1, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default Bpdu filter is enabled BPDU: sent 63, received 2As shown above, BPDU Filter is enabled on GigabitEthernet0/0 of SW3. This interface no longer participates in BPDU transmission or processing.
Configuring BPDU Filter on SW5
Enable BPDU Filter on the interface:
SW5# conf t Enter configuration commands, one per line. End with CNTL/Z. SW5(config)# interface g0/0 SW5(config-if)# spanning-tree bpdufilter enable SW5(config-if)# endVerify the configuration:
SW5# show spanning-tree interface g0/0 detail Port 1 (GigabitEthernet0/0) of VLAN0001 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.1. Designated root has priority 32769, address 5035.7404.6900 Designated bridge has priority 32769, address 5035.7404.6900 Designated port id is 128.1, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default Bpdu filter is enabled BPDU: sent 825, received 63This confirms that BPDU Filter is active on GigabitEthernet0/0 of SW5, effectively stopping the exchange of BPDUs on this link.
Disabling BPDU Filter on Individual Ports
If you need to disable it on a specific interface, use the following command:
Switch# conf t Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface g0/0 Switch(config-if)# spanning-tree bpdufilter disableEffects of Individual BPDU Filter
No BPDU Transmission:
The port will not send BPDUs, reducing unnecessary traffic and preventing the sharing of STP topology information.BPDU Ignorance:
The port will ignore any BPDUs it receives.STP Disabled on Port:
WARNING: Enabling BPDU Filter effectively disables STP on the port, which can lead to network loops if not managed carefully. Always ensure the feature is only enabled on ports where STP is not required.
Answer the question below
What command enables BPDU Filter on a single interface?
Now that we've learned how to configure it on individual ports, let's explore how to set it up globally.
Configuring BPDU Filter globally simplifies the process by automatically applying the filter to all PortFast-enabled ports on the switch. This ensures that ports connected to end-user devices, such as PCs and printers, do not send BPDUs.
Figure 5 – Global BPDU Filter applies to all PortFast-enabled access ports
The first step is to verify that our PortFast-enabled interfaces are correctly configured for end-user devices.
Enable BPDU Filter Globally
SW1(config)# spanning-tree portfast edge bpdufilter default SW1(config)# endThis command configures BPDU Filter on all ports that have PortFast enabled, ensuring that these ports do not send BPDUs by default.
Verify Interfaces
SW1# show spanning-tree int g0/1 detail Port 2 (GigabitEthernet0/1) of VLAN0001 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.2. Designated root has priority 32769, address 5030.9804.6800 Designated bridge has priority 32769, address 5030.9804.6800 Designated port id is 128.2, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 The port is in the portfast edge mode Link type is point-to-point by default Bpdu filter is enabled by default BPDU: sent 2071, received 0SW1# show spanning-tree int g0/2 detail Port 3 (GigabitEthernet0/2) of VLAN0001 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.3. Designated root has priority 32769, address 5030.9804.6800 Designated bridge has priority 32769, address 5030.9804.6800 Designated port id is 128.3, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 The port is in the portfast edge mode Link type is point-to-point by default Bpdu filter is enabled by default BPDU: sent 870, received 0As you can see again, these outputs confirm the feature is enabled on our interfaces, effectively preventing them from sending BPDUs.
Figure 6 – Global BPDU Filter prevents all PortFast ports from sending BPDUs
Effects of Global BPDU Filter
BPDU Filter Applied to All PortFast-Enabled Ports:
All ports with PortFast enabled will no longer send BPDUs, reducing unnecessary traffic and enhancing security.
Ports Will Not Send BPDUs:
By not sending BPDUs, these ports help prevent the leakage of sensitive STP topology information to end-user devices.
Fallback Mechanism:
If a port configured with BPDU Filter receives a BPDU, both PortFast and BPDU Filter are automatically disabled. The port then reverts to a standard STP port to ensure network stability.
Answer the question below
Which feature must be active for global BPDU Filter to apply?
BPDU Filter is a valuable feature for securing STP topology information and controlling BPDU exchanges. When applied correctly, it strengthens security and helps maintain a stable, loop-free topology.
Key Takeaways
Individual Port Mode: Use for specific ports with caution to avoid disabling STP unintentionally.
Global Mode: Recommended for protecting all PortFast-enabled ports in scenarios where security is a priority.
Fallback Mechanism: In global mode, receiving a BPDU automatically reverts the port to normal STP operation to protect the network.
Next, we’ll explore Root Guard, another STP security feature that prevents unauthorized switches from becoming the Root Bridge.
Answer the question below
Click 'Complete' to continue