On Thu, Mar 26, 2009 at 4:29 PM, <[email protected]> wrote: > Hi, > > > spanning-tree bpduguard enable > > spanning-tree bpdufilter enable > > > > Thinking this recommendation came from Cisco Works, it follows that this > > would make sense to do, right? As some more information on the effect of > > these commands has come to light, this is really not a good idea. The > > commands almost seem to serve opposite purposes - one shuts the port down > if > > a bpdu is detected, the other obstensibly ignores bpdus. Which one of > these > > commands takes precendence? > > > > >From what I understand, spanning-tree portfast will in effect serve the > same > > purpose as spanning-tree bpdufilter enable IF the port is an active > access > > port...is that correct? > > no. spanning-tree portfast wont listen/discover/span. if you want it do > do this, you need to have the global spanning-tree command
Right, it goes immediately from not active into forwarding state. > > > spanning-tree portfast bpdufilter default > > this will filter on portfast (what you alluded to). So, I need to add this "spanning-tree portfast bpdufilter default" if I want bpdufilter as the default condition of interfaces configured with portfast...correct? The question is, if I'm using bpduguard on an interface, is there any additional protection afforded by bpdufilter? > > > however, if you have a switch in portfast mode then it should never receive > a bpdu from that port - if it does then something aint right on the > network. > so perhaps it is worth having protection - which is what bpduguard does. > > incidentally, it appears that some of this behvaiour changes from IOS to > IOS - we had many links with spanning-tree portfast trunk enabled... > and they got clobbered by bpduguard seeing bpdu coming down those links > from the other end switch - which we knew about....caveat empor etc > > alan I prefer the "protection" of bpduguard over bpdufilter. Sure, it's more drastic, but its more idiot proof ...ok...idiot-resistent as well. Thanks.... -- To him who is able to keep you from falling and to present you before his glorious presence without fault and with great joy _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
