Spanning tree portfast
Hello,
If I have port configure as spanning tree portfast and I plugged another switch instead of computer what will happened can it create loop or shutdown the port?
Hello horacio27,
You can use PortFast on access switch ports or trunk ports that are connected to a single workstation, server to allow those devices to connect to the network immediately, instead of waiting for the port to transition from the listening and learning states to the forwarding state.
You can use PortFast to connect a single end station or a switch port to a switch port. If you enable PortFast on a port that is connected to another Layer 2 device, such as a switch, you might create network loops.
To Prevent loops, in network the most secure implementation of PortFast is to enable it only on ports that connect end stations to switches. Because PortFast can be enabled on nontrunking ports connecting two switches, spanning tree loops can occur because BPDUs are still being transmitted and received on those ports.
PortFast with BPDU guard prevents loops by moving non trunking port to err-disable state.
Similar Messages
-
Rapid spanning tree / portfast
hello together,
i have a question about rapid spanning tree.
If I enable per vlan rapid spanning tree do i have to configure portfast on the access ports or is this nativly done in rstp?
best regards
larsHi Lars,
In RSTP, the access ports are known as "edge" ports. To configure a port as an "edge port" you use the same command to enable portfast to do this.
"Edge portsIf you configure a port as an edge port on an RSTP switch by using the spanning-tree portfast interface configuration command, the edge port immediately transitions to the forwarding state. An edge port is the same as a Port Fast-enabled port, and you should enable it only on ports that connect to a single end station."
http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12113ea1/3550scg/swmstp.htm
HTH,
Bobby
*Please rate helpful posts. -
Hi all,
i read that portfast should only be enabled on access ports not on trunk ports.
when this command is used
spanning-tree portfast trunk?
under what cases we will use portfast command on trunk port ?
thanks
mahesh.... and there is one more case:
you have access switch full of users and you want to provide them redundancy for internet connection, sou you use HSRP for example and now you have switch connected to 2 or more routers with internet links
now, those links between switch and routers are also trunks and the topology is like a triangle with the switch on the tip , omitting PCs for now , at this point the only device taken into consideration is the switch - others don't use STP because routers have configured IP addresses on subinterfaces (each for one VLAN) so they break BRdomain and computers don't care about STP. In this case, you are sure that no routing loop can occur because other devices (all of them are L3) are boundary for that L2 segment and arp requests broadcasted in your LAN stay inside.
What you've just managed to make is faster trunk transition to UP state so after reload of that switch, your users can quickly use network again. -
Enable BPDUGuard on Spanning-tree Portfast Trunk Port: Yes or No?
Hello to all the Cisco Experts,
I have been searching around to get a confirmed answer as per my subject, but yet unable to come into any conclusion that could help me.
This is all started when I configured the switchport configuration for my ESXi Server which is a dot1q trunk port. The reference will be as below URL:
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1006628
The configuration of the switchport will be as below:
interface GigabitEthernet1/0/1
description ESXi
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 11,15
switchport mode trunk
spanning-tree portfast trunk
end
The catch is, I had the bpduguard enabled on the global level in my switch = spanning-tree portfast bpduguard default.
This will enable the bpduguard on the trunk port above due to the switchport is in portfast (the command: spanning-tree portfast trunk).
Some of the guys in this forum mentioned that it is not recommended to have bpduguard on trunk port and some mentioned it is okay to have this.
So, what do you all think on this? Any real life experience dealing with this kind of situtation that can be shared to us over here?
Thank you in advance.Hi Leo,
First of all, I would never, ever, consider any comment of yours as being offensive so don't worry, none taken. :)
Enabling portfast on a trunk is so "yesterday", in my opinion. If a trunk port(s) or an etherchannel is configured correctly, there's a significant chance portfast is irrelevant. The speed to get the ports to go from down to passing traffic is really boils down to one or two seconds.
Perhaps this is at the core of our different views. To my best knowledge, without the PortFast, a trunk - be it a single port or an EtherChannel - will become forwarding 30 seconds after entering the up/up state, not less. This is valid for STP, RSTP, and MSTP. In addition, if a new VLAN is created or added to the list of enabled VLANs on the trunk, it may take additional 30 seconds for that VLAN to become operational (forwarding) on that trunk. There is nothing besides PortFast and Proposal/Agreement that can cut down this time: the STP must go over the Listening-Learning-Forwarding sequence, and RSTP/MSTP must go through the Discarding-Learning-Forwarding sequence. The "one or two seconds" you have mentioned is perhaps the combined delay incurred by autonegotiation, LACP/PAgP, and DTP, but STP will take its own time and will not be deterred by any of these mechanisms.
I see no benefit but mischief when you enable BPDU Guard on an inter-switch link.
Absolutely agree. That is why it doesn't make any sense to put a BPDU Guard on an inter-switch link, and I have never suggested doing that. The original post, however, deals with enabling PortFast on a trunk link that does not go to another switch but rather connects to an ESXi server on which, obviously, different virtual machines are bridged onto different VLANs.
So what is the reaction of the port if you do happen to enable portfast and BPDU guard on an inter-switch link? Wouldn't the two be a "Jekyll & Hyde", wouldn't it?
It would be just the same as enabling PortFast and BPDU Guard on an access port that happens to be connected to another switch. Upon link-up, the port would become forwarding immediately, and after receiving a BPDU, it would be shot down to err-disabled. The fact the port is an access port or a trunk port makes no difference here. Just as before, I stress that this kind of configuration simply isn't meant to be used on inter-switch links. However, on trunks connected directly to routers, servers, autonomous APs supporting several SSIDs mapped to different VLANs, even to IP phones (remember the mini-trunk config used on old switches on which the switchport voice vlan command only instructed CDP to advertise the voice VLAN but did not cause the port to accept tagged frames in the voice VLAN so it had to be configured as a trunk?) - in all these situations, the PortFast can be beneficial. The BPDU Guard is a natural protective companion to the PortFast - wherever PortFast is eligible to be configured, the BPDU Guard is a natural additional protection to be activated as well.
But given the complexity of interconnection of different switches to various stuff going around, we're happy with leaving portfast on a trunk port disabled.
No argument here - but again, this is about trunks between switches on which I would never suggest using the PortFast or the BPDU Guard. The original post is talking about trunks to end hosts (i.e. edge trunk ports if we extend the terminology a little).
Best regards,
Peter -
Purpose of "spanning-tree portfast trunk"
We are going to try out two wireless accesspoints. I won't name the manufacturer. Their tech support asked for two ports in our Catalyst 3750g to be configured as trunk, dot1q, etc., and with "spanning-tree portfast trunk". What is the purpose of this?
Thanks in advance.As Inayath as already described, traditional portfast does not apply to trunked ports. In order for a trunked port to take the portfast status, you need to specify the 'trunk' keyword.
The key thing to understand is why would you use this - trunked ports usually go between switches and you shouldn't be configuring portfast for such connections. However, keep in mind that you usually configure trunked interfaces for connections going to VMs, etc as well. These are typically treated as end hosts but since they may carry multiple VLANs over them, you can configure the port as a trunk.
In such situations, you can go ahead and configure such trunked ports for portfast status as well.
Regards,
Aninda -
BPDU-STP Discrpancy - Help Please - spanning-tree portfast bpduguard
Hi,
I get this discrepancy report by the CicoWorks saying that BPDU-STP is disabled on ports (all te ports on my switch). I have seen a document on this and how to enable this Spanning Tree feature but I am not really sure if I need to do this or not? what is the benefit in having or not having this feature enabled? if enabled, then, wont I get into the port disabling and traffic disrruption business? understanding that there is a time out feature available as well.
Thx,
MasoodHi Masood.
STP BPDUGuard is used only on the ports which are set to STP portfast. As when the portfast is enabled on the switch it trnasitions from blocking --> forwarding as soon as you connect any device on it. If you connect a switch or a bridge, this can cause a STP loop in your network which can bring your entire N/W to halt/down.
STP BPDUguard is specially designed for the edgeports. So as far as you have a centralized control on your network device and no one can connect any device without proper approval (your) ,you can have it disable. But if you understand the potential impact of connecting a switch or a bridge by anyone without proper authority then you might want it enable it on your switch.
http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a008009482f.shtml
HTH, Please rate if it does.
regards,
-amit singh -
Spanning Tree PortFast BPDU Guard Enhancement
Will this solve our problems interconnecting 2 ports configured in 2 different vlans?
TIAHi Windell,
STP portfast BPDU guard is the feature which is specifically desinged for the ports running stp portfast on them so that a temporary introduction of a switch with lower bridge ID should not disrupt the network topology.At the reception of BPDUs, the BPDU guard operation disables the port that has PortFast configured. The BPDU guard transitions the port into errdisable state.
Please see the link:
http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a008009482f.shtml
I didnot get your question. Can you eleborate more on this.
regards,
-amit singh -
ISE - 802.1X - Loop not detected by spanning-tree
Hello,
I have recently implemented the 802.1X on switchs 3750-X running 15.0(2)SE IOS version.
The spanning-tree bpdufilter and bpduguard are globally enabled on the switchs.
A user has created a loop on the network by connecting its Cisco IP-Phone twice on the network : one wire connected normally from switch to the RJ-45 phone connector and the second wire that should be connected to the PC had also been connected to the switch !
The loop created has not been detected by the switch !
I have made several tests and re-created the problem 3 times on 4 (only one time, the loop has been detected by bpduguard 20 seconds after the port up).
Notice that without 802.1X configured on the same switch port, the loop is quickly detected and ports are err-disabled shutdown.
Switch port with 802.1X is following :
interface GigabitEthernet1/0/9
switchport access vlan 950
switchport mode access
switchport nonegotiate
switchport voice vlan 955
no logging event link-status
authentication control-direction in
authentication event fail action next-method
authentication event server dead action reinitialize vlan 950
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 10
storm-control broadcast level 10.00
storm-control multicast level 10.00
spanning-tree portfast
If I change the host-mode to multi-domain, a MAC violation restriction occurs and shutdown the port. But this is not the config I need.
Is there any reason for spanning-tree not works properly with 802.1X ?
Thanks,
OlivierHello Olivier
When using bpdufilter, bpduguard and portfast all at the same time there are many things going on which are not well documented. Now when you add 802.1x to the mix then you really have no documentation. I had to do many labs on my own to finally have my configuration, and also discovered some bugs. According to my experience you shouldn't use bpdufilter and you should use bpduguard on the switchport not in the global config.
Please read the following links about the differences between global and port bpdufilter, differences between global and port bpduguard, configuring bpduguard along with portfast , configuring bpdufilter along with portfast, and configuring bpduguard along with bpdufilter.
http://aitaseller.wordpress.com/2010/01/17/bpdu-filter-vs-bpdu-guard-what-is-the-difference/
http://costiser.wordpress.com/2011/05/23/subtle-difference-for-portfast-bpdufilter-used-together-globally-or-at-interface-level/
https://learningnetwork.cisco.com/thread/21103
http://blog.ipexpert.com/2010/12/06/bpdu-filter-and-bpdu-guard/
Please rate if this helps -
When is it appropriate to use "spanning-tree bpdufilter enable"
What exactly does enabling bpdu filter do? I see some examples where bpdu filtering is enabled on access ports? Is this correct or are there dangers in this approach?
Hi John,
Simple way of saying would that it would disable the STP on that port.
BPDU filter filters the BPDU's coming in both directions. which means it effectively disable the STP on the port.
Detailed explanation:
===============
BPDUfilter on the other hand just filters BPDUs in both directions, which effectively disables STP on the port.Bpdu filter will prevent inbound and outbound bpdu but will remove portfast state on a port if a bpdu is received.Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops.
Following are the method to configure BPDU Filter in switches
Interface mode:
spanning-tree bpdufilter enable (Results port to not participate in STP, loops may occur).
Global mode:
spanning-tree portfast bpdufilter default (It enables bpdufiltering on ports that have port-fast configuration, so it sends a few bpdu while enabling port then it filters bdpu unless receives a bpdu, after that itchanges from port-fast mode and disables filtering for port to operate like a normal port cause it has received bpdu).
You always should allow STP to run on a switch to prevent loops. However, in special cases when you need to prevent BPDUs from being sent or processed on one or more switch ports, you can use BPDU filtering to effectively disable STP on those ports.you would use bpdufilter when you want a switch plugged into your network but you don't want it participating in spanning tree.
An example: In an office environment where someone needs another network drop under their desk but you don't have time/budget to run a new line for now. you are been given a small switch but don't want it to break spanning tree.The switch you have lying around for this task is a simple unmanaged switch and will only have one uplink into your network. so you put bpdufilter on your switch port.
Ref:https://supportforums.cisco.com/docs/DOC-11825
HTH
Regards
Inayath
*Plz rate if this info is helpfull and mark as answered if this resolved your query. -
Spanning-tree link-type shared
Hi,
i 've this problem.
My PC must boot OS (windows) from network (Server sends Operating System by PC's mac-address)
PC needs a ip-address within 5-10 seconds.
I try it using hub and PC loads correctly OS and works properly.
I try on my network (without hub) using Catalyst Switch in 2 ways:
IOS and CatOS
For the IOS i find this solution:
i use the follows CLI:
spanning-tree portfast
spanning-tree link-type shared
in this case i resolved my problem.
FOR catOS , this command not work properly
i use the follows CLI:
set spantree portfast mod/port enable
set spantree link-type mod/port shared
After, if i see the configuration , i find the CLI
"set spantree mst link-type mod/port shared"
Can you help me?
Thanks
FCostalungaConfiguring a ports STP link type to shared is sort of invalid if the port is also configured as an STP portfast port. 'Shared' effectively means this is a half-duplex connection to a hub that may also be connected to another switch (hence it can't be a point-to-point link). Normal STP operation should operate over 'shared' links and you won't get the rapid start a P2P link has.
If the port is connected directly to a host then simply configuring the port as a portfast port will be enough (it will also make it a P2P link by default).
HTH
Andy -
Hi we are having regular spanning tree issues in our network.
On our config we do not have bpduguard configured from what I can see? Could this be an issue?
What can be done centrally on the core switches to remove this threat? Are their default configs that a wise network administrator would apply as standard?
HELP!HI Mike [Pls Rate if HELPS]
Refer link below for examples and identify redundant links, root and backup root bridge etc..
http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a0080136673.shtml#intro
Refer link for usage guidelines in implementing loopguard, bpdu guard etc..
http://www.cisco.com/en/US/docs/switches/lan/catalyst4000/7.4/configuration/guide/stp_enha.html#wp1019943
A Cisco router will give you a warning when you configure PortFast:
SW1(config)#int fast 0/5
SW1(config-if)#spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single host. Connecting hubs, concentrators, switches, bridges, etc... to this interface when portfast is enabled, can cause temporary bridging loops. Use with CAUTION
%Portfast has been configured on FastEthernet0/5 but will only
have effect when the interface is in a non-trunking mode.
SW1(config-if)#
Not only will the switch warn you about the proper usage of PortFast, but you must put the port into access mode before PortFast will take effect.
But there is a chance - just a chance - that someone is going to manage to connect a switch to a port running Portfast. That could lead to two major problems, the first being the formation of a switching loop. Remember, the reason we have listening and learning modes is to help prevent switching loops. The next problem is that there could be a new root bridge elected - and it could be a switch that isn't even in your network!
BPDU Guard protects against this disastrous possibility. If any BPDU comes in on a port that's running BPDU Guard, the port will be shut down and placed into error disabled state, shown on the switch as err-disabled. A port placed in err-disabled state must be reopened manually.
BPDU Guard is off on all ports by default, and is enabled as shown here:
SW1(config)#int fast 0/5
SW1(config-if)#spanning-tree bpduguard enable
It's a good idea to enable BPDU Guard on any port you're running PortFast on. There's no cost in overhead, and it does prevent the possibility of a switch sending BPDUs into a port configured with PortFast - not to mention the possibility of a switch not under your control becoming a root switch to your network!
Refer link below for Understanding Spanning Tree Protocol:
http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/sw_ntman/cwsimain/cwsi2/cwsiug2/vlan2/stpapp.htm
Hope i am Informative and this HELPS.
PLS RATE if HELPS
Best Regards,
Guru Prasad R -
Cisco Switches and HP Interoperability with Spanning-Tree (RSTP)
Hello All.
I read a lot of information from this forum about Spaning-Tree interoperability between HP Switches and Cisco Switches.
Rather than having questions I would like to post that I manage to configure successfully HP and Cisco using RSTP (802.1w).
SWPADRAO]display stp root
MSTID Root Bridge ID ExtPathCost IntPathCost Root Port
0 32768.cc3e-5f3a-2939 0 0
[SWPADRAO]display stp brief
MSTID Port Role STP State Protection
0 GigabitEthernet1/0/47 DESI FORWARDING NONE
0 GigabitEthernet1/0/48 DESI FORWARDING NONE
[SWPADRAO]display stp instance 0
-------[CIST Global Info][Mode RSTP]-------
CIST Bridge :32768.cc3e-5f3a-2939
Bridge Times :Hello 2s MaxAge 20s FwDly 15s MaxHop 20
CIST Root/ERPC :32768.cc3e-5f3a-2939 / 0
CIST RegRoot/IRPC :32768.cc3e-5f3a-2939 / 0
CIST RootPortId :0.0
BPDU-Protection :enabled
Bridge Config-
Digest-Snooping :disabled
TC or TCN received :17
Time since last TC :0 days 0h:1m:52s
SWNHAM17#show spanning-tree VLAN0001
Spanning tree enabled protocol rstp
Root ID Priority 32768
Address cc3e.5f3a.2939
Cost 4
Port 26 (GigabitEthernet0/2)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 61441 (priority 61440 sys-id-ext 1)
Address 001b.54db.7200
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 Interface Role Sts Cost Prio.Nbr Type
Gi0/1 Altn BLK 4 128.25 P2p
Gi0/2 Root FWD 4 128.26 P2p
SWNHAM18#show spanning-tree VLAN0001
Spanning tree enabled protocol rstp
Root ID Priority 32768
Address cc3e.5f3a.2939
Cost 4
Port 26 (GigabitEthernet0/2)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 61441 (priority 61440 sys-id-ext 1)
Address 001b.0cbc.4300
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 Interface Role Sts Cost Prio.Nbr Type
Gi0/1 Desg FWD 4 128.25 P2p
Gi0/2 Root FWD 4 128.26 P2pHello, David.
Your command doesn't work because it's made only for tha ports that has command "spanning-tree portfast" in them. Try change spanning tree mode at the HP switch to MSTP if this is possible. -
Why the host ports are also seen in the spanning-tree output ?
Why the host ports are also seen in the spanning-tree output ?
Switch1#show spann
VLAN0001
Spanning tree enabled protocol ieee
Root ID Priority 32769
Address 0000.0CA2.138B
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
Address 0000.0CA2.138B
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 20
Interface Role Sts Cost Prio.Nbr Type
Fa0/1 Desg FWD 19 128.1 P2p
Fa0/2 Desg FWD 19 128.2 P2p
Fa0/15 Desg FWD 19 128.15 P2p
interface FastEthernet0/15
description PC0 Interface
switchport mode access
spanning-tree portfast
interface FastEthernet0/16
I read somewhere that all the ports of a switch will participate in STP by default. Is there any way to remove the STP operation on host ports ?
Regards,
ChanduAll ports participate in Spanning Tree by default.
Spanning tree is there to block redundant L2 paths in order to prevent loops. All ports are capable of causing a loop so you would not want to turn spanning tree off, in fact I don't think you can switch it off on a per port basis. You can switch it off on a per vlan basis.
You are already using portfast which allows host ports to transition into a forwarding state without going through the listening and learning states of STP. If you switch off STP on a port, you risk the chance of a L2 loop.
https://supportforums.cisco.com/docs/DOC-5180 -
Spanning-Tree Port Type Edge & Router
I am wondering if a switch trunk port that is facing a router that is connected with subinterface can be classified as an edge port in the eyes of Spanning-Tree.
Thanks.Ricardo
You should configure the switchport as "spanning-tree portfast trunk"
As Glen says that is assuming you are not connecting to a switch module on the router.
Jon -
Portfast vs disabling spanning-tree
hi,
could someone give me an indepth explanation why enabling portfast is not the same as disabling spanning tree with regards to detecting loops?
thanksDisclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
With STP disabled, there's no loop detection.
With Portfast enabled, there's a chance of loop detection. The reason for "chance", a L2 loop could crush the net before a Portfast port's STP reacts. This is why STP listen and learns before it opens the port to normal traffic.
Maybe you are looking for
-
Hi, everybody... I have to realize a videocommunication, whit Apache web server and FMS 3. This's ok... I have a button that load an external .swf but, when the 2 client are into communication, when I push the button, the external .swf starts only on
-
My friend downloaded Kaspersky Anti-Virus and we had no problem - today when I turned on my computer it there was a window that said to download a more current Mc Afee - so I did - now the computer doesn't work. My laptop works so I know it isn't th
-
How to react to Microsoft Word events?
My program runs Microsoft Word (setting "ws" = Word). I can issue commands to Word, but can I also react to Word events? I set ws to be "withevents" but that didn't seem to make wd's events available to my program. Robert Homes
-
Just FYI, NI's Massive seems to have problems under Snow Leopard. When manually quitting Logic from any project using Massive, the app either hangs or complains that the 'Massive plugin quit unexpectedly'. Quick look at the details would suggest some
-
Adding child-component in silent mode
how can i edit my silent script to add new child elements? example: create Server "main_server" as s1; and now to add COM element or ExecuteQueue element to the Server, what is the syntax? Thanks