PortFast, BPDU guard and root guard

PortFast

A port to a PC doesn't need to wait in spanning tree states: spanning-tree portfast makes it an edge port that forwards as soon as the link comes up. Use it only on ports to end devices. spanning-tree portfast default turns it on for every access port.

BPDU guard

A PC never sends BPDUs. If an edge port receives one, someone has plugged in a switch. BPDU guard (spanning-tree bpduguard enable, or spanning-tree portfast bpduguard default) shuts the port into the err-disabled state at once.

Here a user has plugged a small switch, ROGUE, into SW3's Fa0/3, which has BPDU guard:

In NetLab

▶ SW3
SW3>enable
SW3#show logging | include BPDU|ERR
*Mar  1 00:00:00.000: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet0/3 with BPDU Guard enabled. Disabling port.
*Mar  1 00:00:00.000: %PM-4-ERR_DISABLE: bpduguard error detected on Fa0/3, putting Fa0/3 in err-disable state
SW3#show interfaces status err-disabled

Port      Name               Status       Reason               Err-disabled Vlans
Fa0/3                        err-disabled bpduguard
(Unplug the cable between SW3 Fa0/3 and ROGUE)
SW3#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW3(config)#interface fa0/3
SW3(config-if)#shutdown
*Mar  1 00:00:06.000: %LINK-5-CHANGED: Interface FastEthernet0/3, changed state to administratively down
SW3(config-if)#no shutdown
*Mar  1 00:00:07.000: %LINK-3-UPDOWN: Interface FastEthernet0/3, changed state to down
SW3(config-if)#end
*Mar  1 00:00:08.000: %SYS-5-CONFIG_I: Configured from console by console
SW3#show interfaces status | include Fa0/3 |Port
Port      Name               Status       Vlan       Duplex  Speed Type
Fa0/3                        notconnect   1            auto   auto 10/100BaseTX

To recover, remove the cause, then shutdown and no shutdown the port. errdisable recovery cause bpduguard can do this automatically after a timer (300 s by default).

Root guard

Root guard (spanning-tree guard root) goes on ports that should never lead to the root bridge, such as distribution-switch ports facing access switches. If a superior BPDU arrives, the port is put in a root-inconsistent (blocking) state until the superior BPDUs stop.