BPDUGUARD Vs BPDUFILTER
BPDUGUARD Vs BPDUFILTER - What is the difference between these two features?
Both of them are anyways filtering the bpdu then why two separate features?
They are quite dissimilar, actually. The BPDUGuard puts a port into an err-disabled state when a BPDU is received. It is usually put on edge ports as an additional protection technique against possible loops or unauthorized extensions of a network. Should a BPDU be received (no normal workstation ever sends BPDUs!), it is clear that there is something inappropriate connected to that port, and it will be shutdown.
The BPDUFilter prevents BPDUs from being sent and received on an interface. The BPDUFilter is essentially a way how to "turn off" STP on a particular port. A port with BPDUFilter activated directly in the interface configuration won't send any BPDUs, and will ignore all received BPDUs as if they never came. The BPDUFilter can be also activated globally using the command spanning-tree portfast bpdufilter default in which case it applies only to PortFast-enabled ports, and it behaves differently in that case: when a port comes up, it sends 10-11 BPDUs and then it stops sending BPDUs. If it ever receives a BPDU, the BPDUFilter (and the PortFast as well) is deactivated on that port and the port becomes a normal non-edge STP-participating port that receives and sends BPDUs just like any other port - until the port is disconnected.
While these two features may seem similar, they are quite unlike. As a single example, a BPDUFilter by itself will never cause a port to become blocking or shutdown while the BPDUGuard will make just that.
Comments
Post a Comment