Various layer 2 security features

[Darby Weaver]

Color me crazy...

1. spanning-tree portfast enable -> We all know why.

2. spanning-tree portfast bpduguard enable -> Stops send/receive of spanning-tree bpdu's BUT:

when BPDU is received on the port with bpdufilter enabled, the port is portfast status is disabled and port will participate in spanning-tree. At this time network needs to be protected from unauthorized device that might decide to participate in your spanning-tree topology and cause spanning-tree loop or try to hijack root.

So...

3. spanning-tree bpduguard enable -> Errdisables the port when a bpdu is received and may cause a little extra admin overhead but... that's what we get paid for... or you can use the errdisable recovery mechanism but you'll probably need to fix the situation anyway.

Umm... in my world it is far better to err-disable the newcomer rather that let me network take a hit that might affect production.

FYI - If it it of any consequence CiscoWorks will also note this in error if one uses one of the above without the other:

http://www.cisco.com/en/US/docs/net_...html#wp1112009