Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
3.5.4. STP Protection Mechanisms
| Feature | Purpose | Action |
|---|---|---|
| BPDU Guard | Disable port if BPDU received | Err-disable port |
| BPDU Filter | Stop sending/receiving BPDUs | Disables STP |
| Root Guard | Prevent switch from becoming root | Block superior BPDUs |
| Loop Guard | Prevent unidirectional link failure | Block if no BPDUs received |
Where each one goes: PortFast and BPDU Guard belong on access (edge) ports facing end devices. Root Guard goes on designated ports facing switches that must never become root; Loop Guard goes on switch-to-switch root and alternate ports, which expect a steady stream of BPDUs.
BPDU Guard Configuration (recommended with PortFast):
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable
Enable globally:
Switch(config)# spanning-tree portfast bpduguard default
Verification:
Switch# show spanning-tree vlan 10
Switch# show spanning-tree interface GigabitEthernet0/1 detail
Switch# show spanning-tree summary
Enroll to unlock the 3 practice questions written for this section, so you can test what you just read while it is fresh.
Enroll to unlock the 1 flashcard for this section and review them on a spaced-repetition schedule.
Written byAlvin Varughese
Founder•20 professional certifications