Discussion and Explanation of BPDU Guard (With Cisco Config Example)

Spanning Tree Protocol (STP) is a mechanism that is used on network switches to eliminate layer 2 loops.

Within the framework of STP operations, there are various additional features that can be enabled to further protect a topology from malicious users that may attempt to leverage STP to their advantage.

BPDU Guard is one of those features. In this article, we’ll examine its purpose, how it works, some best practices, and how it can be applied on a Cisco switch.

STP Review

STP-enabled switches will exchange Bridge Protocol Data Units or BPDUs to communicate STP-related information.

Using the BPDUs, switches will decide which ports to block and which ports will forward traffic in such a way so that no layer 2 loops are formed in the topology.

Take a look at the following topology:

Let’s say that the STP topology has converged with SW1 chosen to be the root bridge. That means that all of the ports on SW1 must be designated ports, that is, they must forward traffic.

The ports on SW2 and SW3 that face the root bridge, by definition, will become root ports, which also forward traffic.

The ports on SW2 and SW3 that connect to each other must choose one port to become a designated port and the other to become a blocked port. As you can see, the port on SW3 has become blocked.

STP Attack Scenario

This is a perfectly functioning STP topology. However, what happens if a malicious user decides to try to trick SW2 into believing that there is another link that leads to the root bridge? Take a look at this scenario:

We have an attacker that is masquerading as a switch, and he connects to both SW1 and SW2, and sends superior BPDUs to both of those switches.

The result is a reconvergence of the STP topology making the attacker the root bridge. The attacker can now act as a “man in the middle” and read all data between SW1 and SW2 while relaying the data without any disruption to data flow, allowing him to remain undetected.

Mitigating STP Attacks with BPDU Guard

BPDU Guard is a feature that helps to mitigate against these types of attacks. BPDU Guard is a feature that you can enable on a per-interface basis. When enabled, a port will immediately shut down if a BPDU is received, regardless of the priority of that BPDU.

In the above diagram, SW1 and SW2 have been configured with BPDU Guard on their attacker-facing interfaces.

When a BPDU is received on these ports, they immediately enter an err-disabled state, which is essentially the same as being shutdown.

They can only be reenabled if they are manually shut down and reenabled. A Syslog message is logged that indicates that the reason for the shutdown was a violation of the BPDU Guard feature.

Best Practices

BPDU Guard should be enabled on access ports where only end devices such as PCs, printers, IP phones, and servers are expected to be connected. That way, if a BPDU is detected, you know that someone inadvertently or maliciously connected a switch to a port where it should not be connected.

BPDU Guard is typically configured in conjunction with PortFast. PortFast is a feature that is also enabled on access ports where end devices are connected.

It is used to skip the listening and learning phases of the STP protocol, allowing immediate communication upon connection.

By enabling BPDU Guard on all PortFast-enabled ports, you are helping to protect the switch from unexpected BPDUs that may cause STP topology reconvergence and, ultimately, network failures.

Configuration Examples on a Cisco Switch

There are various ways that BPDU Guard can be implemented.

Enabling BPDU Guard on a single port

The following configuration will enable BPDU Guard on the GigabitEthernet 0/0 interface on SW1:

SW1(config)#interface GigabitEthernet 0/0
SW1(config-if)#spanning-tree bpduguard enable

Now if a BPDU is detected on this interface, the following will occur:

SW1#
%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi0/0 with BPDU Guard enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi0/0, putting Gi0/0 in err-disable state
: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
*Mar 1 00:19:32.089: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to down

You can see that the port is being put in ERR_DISABLE state due to a bpduguard error. To bring it back up, you must shut it and reenable it like so:

SW1(config-if)#shutdown
SW1(config-if)#no shutdown

Enable BPDU Guard on all PortFast enabled interfaces

A more appropriate approach to enabling BPDU Guard is to enable it by default on all ports configured with PortFast. This can be done using the following global configuration mode command:

SW1(config)# spanning-tree portfast bpduguard default

The result is that all those ports configured with PortFast will have BPDU Guard enabled by default. This is best practice since this protects the switch from both inadvertent connections to other switches, as well as malicious transmission of BPDUs on such ports.

Verifying configuration

To verify BPDU Guard configurations, you can use the following show command:

SW2#show spanning-tree summary

Switch is in pvst mode
Root bridge for: none
Extended system ID is enabled
Portfast Default is enabled
PortFast BPDU Guard Default is enabled
Portfast BPDU Filter Default is disabled
Loopguard Default is disabled
EtherChannel misconfig guard is enabled
UplinkFast is disabled
BackboneFast is disabled
Configured Pathcost method used is short

In the above output you can see that the BPDU Guard feature is enabled by default on all PortFast-enabled interfaces.

A note on different STP versions

There are various versions of STP, including RSTP, PVST+, MSTP, and others, and in many cases, different STP features function differently in each version.

BPDU Guard is one of the few features of STP that works across different STP versions. It prevents unauthorized switches from participating in STP by disabling a port immediately if a BPDU is received.

Conclusion

BPDU Guard is a vital security feature that protects STP environments from unauthorized topology changes by disabling ports that receive unexpected BPDUs. This prevents malicious attacks and accidental loops, ensuring network stability.

Best practice is to enable BPDU Guard on all PortFast-enabled access ports, where only end devices should connect. It works across all **STP versions** and can be configured per interface or globally on Cisco switches.

By implementing BPDU Guard, network administrators enhance security, prevent STP manipulation, and maintain a resilient network infrastructure.