Unit 1: Network Infrastructure
This will allow you to demonstrate your networking skills, knowledge, and abilities, with a focus on enterprise-level switching, routing, and multicast components that support cross-platform (inter)operability and integration with the most recent software-defined technologies.
It is possible to prevent malicious BPDUs with the spanning tree BPDU filter, which functions in a manner that is comparable to that of BPDU Guard. BPDUguard will place the interface that receives the BPDU into err-disable mode, whereas BPDU filter will simply “filter” it. This is the crucial distinction between these two features. Let’s take a detailed look at the operation of the BPDU filter.
While the BPDU filter can be specified on the interface level or on a global level, there is a distinction between the two:
- At Global Level :- Every interface that has portfast enabled will not send or receive any BPDUs if you enable the BPDU filter globally. This applies to any interface that has portfast enabled. When you receive a BPDU on an interface that is enabled with portfast, the interface will lose its portfast status, the BPDU filtering feature will be disabled, and it will function as a regular interface.
- At interface Level:- If you enable the BPDU filter on the interface, it will not send any BPDUs and will ignore any incoming BPDUs. Putting this into action is the same as turning off the spanning tree.
When you turn on the BPDU filter, you need to be careful. It can be set up on interfaces that are in access mode and connect to computers, but never on interfaces that are linked to other switches. If you do, you could get a loop.
Configuration
To show how the BPDU filter works, let’s use the following topology:
Let’s turn on BPDU filter and portfast on SW2’s interface:
SW2(config)#interface fa0/21
SW2(config-if)#spanning-tree portfast trunk
SW2(config-if)#spanning-tree bpdufilter enable
It will cease transmitting BPDUs and disregard any incoming data. We can see what it does if we enable debugging:
