CCNA 200-301 v1.1 reference — Network Access

STP protection features

PortFast, BPDU guard and BPDU filter, root guard and loop guard: what each protects and where to apply it.

Objective 2.5v1.1 exam target

STP protection features

Feature	Purpose	Apply to	Violation behavior
PortFast	Skip learning states — forward immediately	Edge ports (hosts, phones, servers)	n/a — speeds edge bring-up
BPDU guard	Shut the port down if any BPDU arrives	Edge ports with PortFast	err-disables the port
BPDU filter	Don't send BPDUs; ignore received ones	Edge ports (dangerous uplink misuse)	Port effectively leaves STP — loop risk
Root guard	Keep this port from becoming root port	Ports toward untrusted/downstream switches	Puts port in root-inconsistent (blocked) state until BPDUs stop
Loop guard	Block if BPDUs stop on a non-designated port	Redundant uplinks	Prevents a unidirectional link from opening a loop

The classic pairing is PortFast + BPDU guard on every edge port: the host comes up instantly, and any switch accidentally patched in produces a BPDU that err-disables the port before it can create a loop. Root guard belongs on ports where you must never accept a better root (toward other organizations' or untrusted switches); loop guard protects against unidirectional link failures where a port stops hearing BPDUs and could start forwarding.

BPDU filter is different from BPDU guard: it suppresses BPDUs entirely — the port acts as if STP does not exist there. Configured at interface level it can create loops if misused; configured globally (spanning-tree portfast bpdufilter default) it applies only to PortFast ports and loses filter status when a BPDU arrives.

Configuration and verification

Protect an edge port

Fast edge port with loop safety — Privileged EXEC → Interface configuration

Cisco IOS / IOS XE

configure terminal
interface gigabitethernet1/0/5
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
 end

Verify

show spanning-tree interface gi1/0/5 portfast
show running-config interface gi1/0/5
show interfaces status err-disabled

PortFast enabled on the port.
A BPDU-guard trip shows the port err-disabled — find the cause before re-enabling.

Global defaults exist: spanning-tree portfast default and spanning-tree portfast bpduguard default.
Never PortFast a link toward another switch.

Changes device configuration.

What happens when a switch is patched into a desk port

Port: Gi1/0/5 — PortFast + BPDU guard
Event: User plugs a small switch into their jack

The rogue switch starts sending BPDUs claiming STP participation.
BPDU guard sees BPDUs on an edge port → err-disables Gi1/0/5; the loop risk is reduced, not eliminated (a transient loop can still exist).
The port stays down until an operator re-enables it (or errdisable recovery fires, if configured).

The loop never forms — protection acts on the first BPDU, before forwarding can loop.

Common mistakes

Applying PortFast to trunk/uplink ports — bypasses the learning states that prevent loops during topology changes.
Confusing BPDU guard (shuts the port down) with BPDU filter (ignores BPDUs — higher loop risk).
Deploying root guard on normal edge ports — it belongs on inter-switch boundary ports.
Relying on errdisable recovery without fixing the cause — the port will re-disable.

An access port keeps going err-disabled

Observation: Gi1/0/12 repeatedly err-disables minutes after being re-enabled.

Hypotheses

A rogue switch is patched into the port, sending BPDUs (a passive hub alone does not generate BPDUs)
A bridging loop exists between two desk jacks
Errdisable recovery re-enables before the cause is removed

Check	Indicates
`show interfaces status err-disabled`	Confirms the disable reason is bpduguard.
CDP/LLDP neighbor on the port	Identifies what device is actually attached.
Physical inspection / desk jack mapping	Two jacks cabled together produce looping BPDUs.

Correction: Remove the rogue device/loop, then shutdown/no shutdown to restore the port.

Port stays up and no new BPDUs arrive on it.

On this page

STP protection features
Configuration and verification

Related resources

Practise this topic Source topic 21: Spanning Tree Protocol (Part 2 & STP Toolkit)Practise topic 21 deck

Sources

Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
IEEE 802.1 Working Group — reviewed 2026-11-02
Cisco — LAN Switching Command Reference — reviewed 2026-11-02

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.