BPDUGUARD Vs BPDUFILTER



 

BPDUGUARD Vs BPDUFILTER - What is the difference between these two features? 

 

Both of them are anyways filtering the bpdu then why two separate features?

They  are quite dissimilar, actually. The BPDUGuard puts a port into an  err-disabled state when a BPDU is received. It is usually put on edge  ports as an additional protection technique against possible loops or  unauthorized extensions of a network. Should a BPDU be received (no  normal workstation ever sends BPDUs!), it is clear that there is  something inappropriate connected to that port, and it will be shutdown.

The  BPDUFilter prevents BPDUs from being sent and received on an interface.  The BPDUFilter is essentially a way how to "turn off" STP on a  particular port. A port with BPDUFilter activated directly in the interface configuration won't send any BPDUs, and will ignore all received BPDUs as if they  never came. The BPDUFilter can be also activated globally using the  command spanning-tree portfast bpdufilter default in which case  it applies only to PortFast-enabled ports, and it behaves differently in  that case: when a port comes up, it sends 10-11 BPDUs and then it stops  sending BPDUs. If it ever receives a BPDU, the BPDUFilter (and the  PortFast as well) is deactivated on that port and the port becomes a  normal non-edge STP-participating port that receives and sends BPDUs  just like any other port - until the port is disconnected.

While these two features may seem similar, they are quite unlike. As a single example, a BPDUFilter by itself will never cause a port to become blocking or shutdown while the BPDUGuard will make just that.

Comments

Popular posts from this blog

MPLS L2 VPN Types

Multiple Cisco device configuration Backup using python Script

Profile Based IKEv1 GRE Tunnel Configuration in Huawei Router