The spanning tree toolkit: BPDU Filter, Loop Guard, UDLD, Bridge Assurance and PortFast behaviour

Why spanning tree needs extra protection

Spanning tree assumes that if a port stops hearing BPDUs, the switch on the other side has gone away. That is usually true, but not if a fibre strand breaks in one direction, a switch's software hangs while its ports stay up, or BPDUs are filtered by mistake. In those cases a blocked port may start forwarding and create a loop. The features below close those gaps. Spanning tree in practice covers PortFast, BPDU Guard and Root Guard; this note covers the rest.

PortFast: what it does and does not do

A common belief is that PortFast disables spanning tree on a port. It does not. A PortFast port skips listening and learning and forwards at once, and it does not cause topology changes, but it still sends BPDUs and still processes any it receives. If a switch is plugged in, an RSTP edge port loses its edge status as soon as it hears a BPDU and behaves normally, so a loop is still detected. Pair PortFast with BPDU Guard on user ports anyway, so a rogue switch is shut out.

spanning-tree portfast edge default
spanning-tree portfast edge bpduguard default
interface GigabitEthernet1/0/40
 description ESXi host trunk
 spanning-tree portfast edge trunk

The global commands apply to access ports only; trunks to servers need the per-interface trunk keyword. Older software uses the same commands without the word edge.

BPDU Filter

BPDU Filter stops a port from sending BPDUs, and behaves very differently depending on where you enable it:

• Globally (spanning-tree portfast bpdufilter default): PortFast ports stop sending BPDUs after a few at start-up. If one receives a BPDU, it loses PortFast and filtering, and takes part in spanning tree normally. Relatively safe.
• On an interface (spanning-tree bpdufilter enable): the port neither sends nor processes BPDUs, which really does remove it from spanning tree. A loop through that port is never detected.

Use interface-level filtering only at deliberate boundaries, such as a link to another organisation that must not join your tree, and document it.

Loop Guard and UDLD: one-way links

If a fibre pair loses one strand, a switch may still send but no longer receive. A blocked port that stops hearing BPDUs would, after max age, become designated and forward: a loop. Loop Guard prevents this on root and alternate ports. When BPDUs stop arriving, the port moves to a loop-inconsistent blocking state instead, and recovers by itself when BPDUs return.

UDLD (UniDirectional Link Detection), a Cisco protocol, attacks the problem at Layer 2. Both ends exchange messages containing their own and their neighbour's identity. If a switch stops seeing itself echoed back, the link is one-way. In normal mode UDLD only logs this; in aggressive mode it also err-disables the port after trying to re-establish the link.

spanning-tree loopguard default
udld aggressive
interface TenGigabitEthernet1/1/1
 udld port aggressive
show udld neighbors

Global udld commands only cover fibre ports; enable it per interface for copper. Both ends must run UDLD. Loop Guard and UDLD complement each other, and many designs use both on uplinks.

Dispute and Bridge Assurance

RSTP has a built-in dispute check. If a designated port receives an inferior BPDU that claims to come from a designated port in the learning or forwarding state, the two switches clearly disagree, which usually means one is not hearing the other. The receiving switch moves its port to discarding until the dispute clears. It needs no configuration.

Bridge Assurance, available on some Cisco platforms, turns BPDUs into a two-way keepalive. On ports set as network ports (spanning-tree portfast network), every port, including blocked ones, sends BPDUs each hello. If a port stops receiving them, it goes into a Bridge Assurance inconsistent state instead of forwarding. It must be enabled at both ends, so only use it on links between switches that both support it.

Real-world example: a manufacturing plant suffered a network-wide outage every few weeks, always on the production floor. Logs eventually showed that a damaged fibre between two buildings sometimes lost one strand. The blocked end stopped receiving BPDUs, started forwarding and created a broadcast storm. The engineers enabled UDLD aggressive mode on all fibre uplinks and Loop Guard globally. The next time the fibre failed, the port was err-disabled with a clear UDLD message, the redundant link took over and production continued while the fibre was replaced.