Portfast vs disabling spanning-tree

hi,
could someone give me an indepth explanation why enabling portfast is not the same as disabling spanning tree with regards to detecting loops?
thanks

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
With STP disabled, there's no loop detection.
With Portfast enabled, there's a chance of loop detection. The reason for "chance", a L2 loop could crush the net before a Portfast port's STP reacts. This is why STP listen and learns before it opens the port to normal traffic.

Similar Messages

Can I disable spanning-tree in a vpc domain ?

i have two N7718s in a vpc domain and each have a vpc connection to 300+ TORs(non cisco switch).
each 7718 have 300+ trunk port and a trunk port carring 80 vlans . so the logical port number is 300*80 = 24000
the problem is n7k r-pvst logical ports limit is 16000,it causes the vpc primary 7718 ping latancy time exceed 1000ms
2 ways to solve this problem : use mst instead of rpvst or disable spanning-tree
if i use mst , the logical ports limit is 90000, the problem will appear one day
so i want to disable spanning-tree . 7718s' vpc link to TOR use lacp ,it will prevent some layer2 loops. can i do it?

I have the same problem. :)

Enable BPDUGuard on Spanning-tree Portfast Trunk Port: Yes or No?

Hello to all the Cisco Experts,
I have been searching around to get a confirmed answer as per my subject, but yet unable to come into any conclusion that could help me.
This is all started when I configured the switchport configuration for my ESXi Server which is a dot1q trunk port. The reference will be as below URL:
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1006628
The configuration of the switchport will be as below:
interface GigabitEthernet1/0/1
description ESXi
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 11,15
switchport mode trunk
spanning-tree portfast trunk
end
The catch is, I had the bpduguard enabled on the global level in my switch = spanning-tree portfast bpduguard default.
This will enable the bpduguard on the trunk port above due to the switchport is in portfast (the command: spanning-tree portfast trunk).
Some of the guys in this forum mentioned that it is not recommended to have bpduguard on trunk port and some mentioned it is okay to have this.
So, what do you all think on this? Any real life experience dealing with this kind of situtation that can be shared to us over here?
Thank you in advance.

Hi Leo,
First of all, I would never, ever, consider any comment of yours as being offensive so don't worry, none taken. :)
Enabling portfast on a trunk is so "yesterday", in my opinion. If a trunk port(s) or an etherchannel is configured correctly, there's a significant chance portfast is irrelevant. The speed to get the ports to go from down to passing traffic is really boils down to one or two seconds.
Perhaps this is at the core of our different views. To my best knowledge, without the PortFast, a trunk - be it a single port or an EtherChannel - will become forwarding 30 seconds after entering the up/up state, not less. This is valid for STP, RSTP, and MSTP. In addition, if a new VLAN is created or added to the list of enabled VLANs on the trunk, it may take additional 30 seconds for that VLAN to become operational (forwarding) on that trunk. There is nothing besides PortFast and Proposal/Agreement that can cut down this time: the STP must go over the Listening-Learning-Forwarding sequence, and RSTP/MSTP must go through the Discarding-Learning-Forwarding sequence. The "one or two seconds" you have mentioned is perhaps the combined delay incurred by autonegotiation, LACP/PAgP, and DTP, but STP will take its own time and will not be deterred by any of these mechanisms.
I see no benefit but mischief when you enable BPDU Guard on an inter-switch link.
Absolutely agree. That is why it doesn't make any sense to put a BPDU Guard on an inter-switch link, and I have never suggested doing that. The original post, however, deals with enabling PortFast on a trunk link that does not go to another switch but rather connects to an ESXi server on which, obviously, different virtual machines are bridged onto different VLANs.
So what is the reaction of the port if you do happen to enable portfast and BPDU guard on an inter-switch link? Wouldn't the two be a "Jekyll & Hyde", wouldn't it?
It would be just the same as enabling PortFast and BPDU Guard on an access port that happens to be connected to another switch. Upon link-up, the port would become forwarding immediately, and after receiving a BPDU, it would be shot down to err-disabled. The fact the port is an access port or a trunk port makes no difference here. Just as before, I stress that this kind of configuration simply isn't meant to be used on inter-switch links. However, on trunks connected directly to routers, servers, autonomous APs supporting several SSIDs mapped to different VLANs, even to IP phones (remember the mini-trunk config used on old switches on which the switchport voice vlan command only instructed CDP to advertise the voice VLAN but did not cause the port to accept tagged frames in the voice VLAN so it had to be configured as a trunk?) - in all these situations, the PortFast can be beneficial. The BPDU Guard is a natural protective companion to the PortFast - wherever PortFast is eligible to be configured, the BPDU Guard is a natural additional protection to be activated as well.
But given the complexity of interconnection of different switches to various stuff going around, we're happy with leaving portfast on a trunk port disabled.
No argument here - but again, this is about trunks between switches on which I would never suggest using the PortFast or the BPDU Guard. The original post is talking about trunks to end hosts (i.e. edge trunk ports if we extend the terminology a little).
Best regards,
Peter

When is it appropriate to use "spanning-tree bpdufilter enable"

What exactly does enabling bpdu filter do? I see some examples where bpdu filtering is enabled on access ports? Is this correct or are there dangers in this approach?

Hi John,
Simple way of saying would that it would disable the STP on that port.
BPDU filter filters the BPDU's coming in both directions. which means it effectively disable the STP on the port.
Detailed explanation:
===============
BPDUfilter on the other hand just filters BPDUs in both directions, which effectively disables STP on the port.Bpdu filter will prevent inbound and outbound bpdu but will remove portfast state on a port if a bpdu is received.Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops.
Following are the method to configure BPDU Filter in switches
Interface mode:
spanning-tree bpdufilter enable                        (Results port to not participate in STP, loops may occur).
Global mode:
spanning-tree portfast bpdufilter default             (It enables bpdufiltering on ports that have port-fast configuration, so it sends a few bpdu while enabling port then it filters bdpu unless receives a bpdu, after that itchanges from port-fast mode and disables filtering for port to operate like a normal port cause it has received bpdu).
You always should allow STP to run on a switch to prevent loops. However, in special cases when you need to prevent BPDUs from being sent or processed on one or more switch ports, you can use BPDU filtering to effectively disable STP on those ports.you would use bpdufilter when you want a switch plugged into your network but you don't want it participating in spanning tree.
An example: In an office environment where someone needs another network drop under their desk but you don't have time/budget to run a new line for now. you are been given a small switch but don't want it to break spanning tree.The switch you have lying around for this task is a simple unmanaged switch and will only have one uplink into your network. so you put bpdufilter on your switch port.
Ref:https://supportforums.cisco.com/docs/DOC-11825
HTH
Regards
Inayath
*Plz rate if this info is helpfull and mark as answered if this resolved your query.

Spanning tree bpdu

Hi all, can anyone tell me 2 things, firstly do only the uplinks on a switch send out bpdu's ? secondly if I disabled spanning tree on the uplink ports would the switch not send any bpdu's out thus the switch not participating in spanning tree to the rest of the network ?

Concept says, by default all switchports are in trunk mode. So if any switch is connectd to a port, it tries to negotiate the trunk & once established, send BPDUs. Thus, all access ports have portfast turned on which denies any BPDUs received on port.
Coming to your point, Yes uplinks will share BPDUs. If ur topology has redundant connections, then you are prone to loops if stp is turned off. However, if ur only concern is to limit the diameter of stp, prefer using "vlan allowed" comand on trunks for stp to limit to specific vlans & thus not flooding entire network.

BPDU-STP Discrpancy - Help Please - spanning-tree portfast bpduguard

Hi,
I get this discrepancy report by the CicoWorks saying that BPDU-STP is disabled on ports (all te ports on my switch). I have seen a document on this and how to enable this Spanning Tree feature but I am not really sure if I need to do this or not? what is the benefit in having or not having this feature enabled? if enabled, then, wont I get into the port disabling and traffic disrruption business? understanding that there is a time out feature available as well.
Thx,
Masood

Hi Masood.
STP BPDUGuard is used only on the ports which are set to STP portfast. As when the portfast is enabled on the switch it trnasitions from blocking --> forwarding as soon as you connect any device on it. If you connect a switch or a bridge, this can cause a STP loop in your network which can bring your entire N/W to halt/down.
STP BPDUguard is specially designed for the edgeports. So as far as you have a centralized control on your network device and no one can connect any device without proper approval (your) ,you can have it disable. But if you understand the potential impact of connecting a switch or a bridge by anyone without proper authority then you might want it enable it on your switch.
http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a008009482f.shtml
HTH, Please rate if it does.
regards,
-amit singh

Spanning tree portfast

Hello,
If I have port configure as spanning tree portfast and I plugged another switch instead of computer what will happened can it create loop or shutdown the port?

Hello horacio27,
You can use PortFast on access switch ports or trunk ports that are connected to a single workstation, server to allow those devices to connect to the network immediately, instead of waiting for the port to transition from the listening and learning states to the forwarding state.
You can use PortFast to connect a single end station or a switch port to a switch port. If you enable PortFast on a port that is connected to another Layer 2 device, such as a switch, you might create network loops.
To Prevent loops, in network the most secure implementation of PortFast is to enable it only on ports that connect end stations to switches. Because PortFast can be enabled on nontrunking ports connecting two switches, spanning tree loops can occur because BPDUs are still being transmitted and received on those ports.
PortFast with BPDU guard prevents loops by moving non trunking port to err-disable state.

Rapid spanning tree / portfast

hello together,
i have a question about rapid spanning tree.
If I enable per vlan rapid spanning tree do i have to configure portfast on the access ports or is this nativly done in rstp?
best regards
lars

Hi Lars,
In RSTP, the access ports are known as "edge" ports. To configure a port as an "edge port" you use the same command to enable portfast to do this.
"Edge portsIf you configure a port as an edge port on an RSTP switch by using the spanning-tree portfast interface configuration command, the edge port immediately transitions to the forwarding state. An edge port is the same as a Port Fast-enabled port, and you should enable it only on ports that connect to a single end station."
http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12113ea1/3550scg/swmstp.htm
HTH,
Bobby
*Please rate helpful posts.

Spanning-tree portfast trunk

Hi all,
i read that portfast should only be enabled on access ports not on trunk ports.
when this command is used
spanning-tree portfast trunk?
under what cases we will use portfast command on trunk port ?
thanks
mahesh

.... and there is one more case:
you have access switch full of users and you want to provide them redundancy for internet connection, sou you use HSRP for example and now you have switch connected to 2 or more routers with internet links
now, those links between switch and routers are also trunks and the topology is like a triangle with the switch on the tip , omitting PCs for now , at this point the only device taken into consideration is the switch - others don't use STP because routers have configured IP addresses on subinterfaces (each for one VLAN) so they break BRdomain and computers don't care about STP. In this case, you are sure that no routing loop can occur because other devices (all of them are L3) are boundary for that L2 segment and arp requests broadcasted in your LAN stay inside.
What you've just managed to make is faster trunk transition to UP state so after reload of that switch, your users can quickly use network again.

Why does the command "spanning-tree mst simulate pvst disable" exist

That's all really. Why would you turn it off? What is the advantage. If you're not receiving PVST BPDUs, you don't need it, but why turn it off?

When you use the spanning-tree mst simulate pvst disable command, specified MST interfaces that receive a Rapid PVST+ (SSTP) bridge protocol data unit (BPDU) move into the STP blocking state. Those interfaces remain in the inconsistent state until the port stops receiving Rapid PVST+ BPDUs, and then the port resumes the normal STP transition process.
OK, that's what it does, but why? the only effect it has is blocking your ports.

Purpose of "spanning-tree portfast trunk"

We are going to try out two wireless accesspoints. I won't name the manufacturer. Their tech support asked for two ports in our Catalyst 3750g to be configured as trunk, dot1q, etc., and with "spanning-tree portfast trunk". What is the purpose of this?
Thanks in advance.

As Inayath as already described, traditional portfast does not apply to trunked ports. In order for a trunked port to take the portfast status, you need to specify the 'trunk' keyword.
The key thing to understand is why would you use this - trunked ports usually go between switches and you shouldn't be configuring portfast for such connections. However, keep in mind that you usually configure trunked interfaces for connections going to VMs, etc as well. These are typically treated as end hosts but since they may carry multiple VLANs over them, you can configure the port as a trunk.
In such situations, you can go ahead and configure such trunked ports for portfast status as well.
Regards,
Aninda

ISE - 802.1X - Loop not detected by spanning-tree

Hello,
I have recently implemented the 802.1X on switchs 3750-X running 15.0(2)SE IOS version.
The spanning-tree bpdufilter and bpduguard are globally enabled on the switchs.
A user has created a loop on the network by connecting its Cisco IP-Phone twice on the network : one wire connected normally from switch to the RJ-45 phone connector and the second wire that should be connected to the PC had also been connected to the switch !
The loop created has not been detected by the switch !
I have made several tests and re-created the problem 3 times on 4 (only one time, the loop has been detected by bpduguard 20 seconds after the port up).
Notice that without 802.1X configured on the same switch port, the loop is quickly detected and ports are err-disabled shutdown.
Switch port with 802.1X is following :
interface GigabitEthernet1/0/9
switchport access vlan 950
switchport mode access
switchport nonegotiate
switchport voice vlan 955
no logging event link-status
authentication control-direction in
authentication event fail action next-method
authentication event server dead action reinitialize vlan 950
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 10
storm-control broadcast level 10.00
storm-control multicast level 10.00
spanning-tree portfast
If I change the host-mode to multi-domain, a MAC violation restriction occurs and shutdown the port. But this is not the config I need.
Is there any reason for spanning-tree not works properly with 802.1X ?
Thanks,
Olivier

Hello Olivier
When using bpdufilter, bpduguard and portfast all at the same time there are many things going on which are not well documented. Now when you add 802.1x to the mix then you really have no documentation. I had to do many labs on my own to finally have my configuration, and also discovered some bugs. According to my experience you shouldn't use bpdufilter and you should use bpduguard on the switchport not in the global config.
Please read the following links about the differences between global and port bpdufilter, differences between global and port bpduguard, configuring bpduguard along with portfast , configuring bpdufilter along with portfast, and configuring bpduguard along with bpdufilter.
http://aitaseller.wordpress.com/2010/01/17/bpdu-filter-vs-bpdu-guard-what-is-the-difference/
http://costiser.wordpress.com/2011/05/23/subtle-difference-for-portfast-bpdufilter-used-together-globally-or-at-interface-level/
https://learningnetwork.cisco.com/thread/21103
http://blog.ipexpert.com/2010/12/06/bpdu-filter-and-bpdu-guard/
Please rate if this helps

The spanning-tree add strange value when I create new Vlans

Hi,
On all switchs access, the spanning-tree add strange value when I create new Vlans from Distrib Layer,
and no association is created with any interface with spanning-tree vlan 700, see below in this exemple,
until I reboot the switch.
somebody already saw this values ?
DSFDS112#sh span sum
Switch is in rapid-pvst mode
Root bridge for: none
EtherChannel misconfig guard is enabled
Extended system ID           is enabled
Portfast Default             is disabled
PortFast BPDU Guard Default is disabled
Portfast BPDU Filter Default is disabled
Loopguard Default            is enabled
UplinkFast                   is disabled
Stack port is StackPort1
BackboneFast                 is disabled
Configured Pathcost method used is long
Name                   Blocking Listening Learning Forwarding STP Active
VLAN0001                     0         0        0          3          3
VLAN0002                     0         0        0         22         22
VLAN0006                     0         0        0          3          3
VLAN0007                     0         0        0          8          8
VLAN0009                     0         0        0          4          4
VLAN0010                     0         0        0          3          3
VLAN0011                     0         0        0          3          3
VLAN0012                     0         0        0          3          3
VLAN0013                     0         0        0          3          3
VLAN0090                     0         0        0         15         15
VLAN0109                     0         0        0          3          3
VLAN0200                     0         0        0          4          4
VLAN0300                     0         0        0         26         26
VLAN0302                     0         0        0          4          4
VLAN0700               -   253 -1872756560 2087191206 -1872756549 2080375982
VLAN0702               -   253 -1872756560 2087191206 -1872756549 2080375982
VLAN0704                     0         0        0          4          4
VLAN0710               -   253 -1872756560 2087191206 -1872756549 2080375982
VLAN0816                     0         0        0          3          3
VLAN0820                     0         0        0          3          3
20 vlans               -   759 -1323302384 1966606322 -1323302237 1946160764
DSFDS112#sh span vlan 700
VLAN0700
Spanning tree enabled protocol rstp
Root ID    Priority    4796
             Address     0008.e3ff.fcbc
             Cost        10000
             Port        608 (Port-channel1)
             Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority    62140 (priority 61440 sys-id-ext 700)
             Address     885a.9213.6880
             Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec
             Aging Time 300 sec
Interface           Role Sts Cost      Prio.Nbr Type
Po1                Root FWD 10000     128.608 P2p
DSFDS112#sh run int Gi1/0/25
Building configuration...
Current configuration : 194 bytes
interface GigabitEthernet1/0/25
description Station12
switchport access vlan 700
switchport mode access
end
DSFDS112#sh span interface Gi1/0/25
no spanning tree info available for GigabitEthernet1/0/25
DSFDS112#sh int status interface Gi1/0/25
Port      Name               Status       Vlan       Duplex Speed Type
Gi1/0/25 Station12          connected    700          full    100 10/100/1000BaseTX
Thanks for your help,
Regards.

Venki,
The ORA-00942 is okay because there is no existing object. But what stuck me is the ORA-01921 error which may indicate that this might not be a new database.
CREATE ROLE exp_full_database
ERROR at line 1:
ORA-01921: role name 'EXP_FULL_DATABASE' conflicts with another user or role name
CREATE ROLE imp_full_database
ERROR at line 1:
ORA-01921: role name 'IMP_FULL_DATABASE' conflicts with another user or role name
Are there any existing databases on this server? Have you tried to create it on other machine?I searched on Metalink too and found Doc ID: 237486.1 ORA-29807 Signalled While Creating Database using DBCA which say that eroror could be ignored. You may want to review that as well.
Ittichai

Spanning tree loops

Hi we are having regular spanning tree issues in our network.
On our config we do not have bpduguard configured from what I can see? Could this be an issue?
What can be done centrally on the core switches to remove this threat? Are their default configs that a wise network administrator would apply as standard?
HELP!

HI Mike [Pls Rate if HELPS]
Refer link below for examples and identify redundant links, root and backup root bridge etc..
http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a0080136673.shtml#intro
Refer link for usage guidelines in implementing loopguard, bpdu guard etc..
http://www.cisco.com/en/US/docs/switches/lan/catalyst4000/7.4/configuration/guide/stp_enha.html#wp1019943
A Cisco router will give you a warning when you configure PortFast:
SW1(config)#int fast 0/5
SW1(config-if)#spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single host. Connecting hubs, concentrators, switches, bridges, etc... to this interface when portfast is enabled, can cause temporary bridging loops. Use with CAUTION
%Portfast has been configured on FastEthernet0/5 but will only
have effect when the interface is in a non-trunking mode.
SW1(config-if)#
Not only will the switch warn you about the proper usage of PortFast, but you must put the port into access mode before PortFast will take effect.
But there is a chance - just a chance - that someone is going to manage to connect a switch to a port running Portfast. That could lead to two major problems, the first being the formation of a switching loop. Remember, the reason we have listening and learning modes is to help prevent switching loops. The next problem is that there could be a new root bridge elected - and it could be a switch that isn't even in your network!
BPDU Guard protects against this disastrous possibility. If any BPDU comes in on a port that's running BPDU Guard, the port will be shut down and placed into error disabled state, shown on the switch as err-disabled. A port placed in err-disabled state must be reopened manually.
BPDU Guard is off on all ports by default, and is enabled as shown here:
SW1(config)#int fast 0/5
SW1(config-if)#spanning-tree bpduguard enable
It's a good idea to enable BPDU Guard on any port you're running PortFast on. There's no cost in overhead, and it does prevent the possibility of a switch sending BPDUs into a port configured with PortFast - not to mention the possibility of a switch not under your control becoming a root switch to your network!
Refer link below for Understanding Spanning Tree Protocol:
http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/sw_ntman/cwsimain/cwsi2/cwsiug2/vlan2/stpapp.htm
Hope i am Informative and this HELPS.
PLS RATE if HELPS
Best Regards,
Guru Prasad R

Cisco Switches and HP Interoperability with Spanning-Tree (RSTP)

Hello All.
I read a lot of information from this forum about Spaning-Tree interoperability between HP Switches and Cisco Switches.
Rather than having questions I would like to post that I manage to configure successfully HP and Cisco using RSTP (802.1w).
SWPADRAO]display stp root
MSTID Root Bridge ID        ExtPathCost IntPathCost Root Port
  0    32768.cc3e-5f3a-2939 0           0
[SWPADRAO]display stp brief
MSTID      Port                         Role STP State     Protection
  0        GigabitEthernet1/0/47        DESI FORWARDING    NONE
  0        GigabitEthernet1/0/48        DESI FORWARDING    NONE
[SWPADRAO]display stp instance 0
-------[CIST Global Info][Mode RSTP]-------
CIST Bridge         :32768.cc3e-5f3a-2939
Bridge Times        :Hello 2s MaxAge 20s FwDly 15s MaxHop 20
CIST Root/ERPC      :32768.cc3e-5f3a-2939 / 0
CIST RegRoot/IRPC   :32768.cc3e-5f3a-2939 / 0
CIST RootPortId     :0.0
BPDU-Protection     :enabled
Bridge Config-
Digest-Snooping     :disabled
TC or TCN received :17
Time since last TC :0 days 0h:1m:52s
SWNHAM17#show spanning-tree VLAN0001
Spanning tree enabled protocol rstp
Root ID    Priority    32768
            Address     cc3e.5f3a.2939
            Cost        4
            Port        26 (GigabitEthernet0/2)
            Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec  Bridge ID Priority    61441 (priority 61440 sys-id-ext 1)
            Address     001b.54db.7200
            Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec
            Aging Time 300 Interface        Role Sts Cost      Prio.Nbr Type
Gi0/1            Altn BLK 4         128.25   P2p
Gi0/2            Root FWD 4         128.26   P2p
SWNHAM18#show spanning-tree VLAN0001
Spanning tree enabled protocol rstp
Root ID    Priority    32768
            Address     cc3e.5f3a.2939
            Cost        4
            Port        26 (GigabitEthernet0/2)
            Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec  Bridge ID Priority    61441 (priority 61440 sys-id-ext 1)
            Address     001b.0cbc.4300
            Hello Time   2 sec Max Age 20 sec Forward Delay 15 sec
            Aging Time 300 Interface        Role Sts Cost      Prio.Nbr Type
Gi0/1            Desg FWD 4         128.25   P2p
Gi0/2            Root FWD 4         128.26   P2p

Hello, David.
Your command doesn't work because it's made only for tha ports that has command "spanning-tree portfast" in them. Try change spanning tree mode at the HP switch to MSTP if this is possible.

Portfast vs disabling spanning-tree

Similar Messages

Maybe you are looking for