Configuring BPDU Guard

1. Enter GigabitEthernet Interface Configuration mode:

   enable

   configure terminal

   interface GigabitEthernet {slot/port[/sub-port][-slot/port[/sub-port]][,...]}

   

   Note

   If the platform supports channelization and the port is channelized, you must also specify the sub-port in the format slot/port/sub-port.

2. Enable BPDU Guard for the port:

   spanning-tree bpduguard enable

3. Optional: Configure the timer for port-state recovery:

   spanning-tree bpduguard timeout <0, 10–65535>

4. Optional: Enable BPDU Guard on an additional port or group of ports:

   spanning-tree bpduguard port {slot/port[/sub-port][-slot/port[/subport]][,...]} enable

5. Optional: Configure the timer for port-state recovery for an additional port or group of ports:

   spanning-tree bpduguard port {slot/port[/sub-port][-slot/port[/subport]][,...]} timeout <0–65535>

6. Verify the configuration:

   show spanning-tree bpduguard [GigabitEthernet {slot/port[/sub-port][-slot/port[/subport]][,...]}] [{slot/port[/sub-port][-slot/port[/subport]][,...]}]

Example

Enable BPDU Guard on port 1/8, and specify a timer value of 200 seconds. Verify the configuration.

Switch:1>enable
Switch:1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch:1(config)#interface gigabitEthernet 1/8
Switch:1(config-if)#spanning-tree bpduguard enable
Switch:1(config-if)#spanning-tree bpduguard timeout 200
Switch:1(config-if)#show spanning-tree bpduguard 1/8

============================================================
                                   Bpdu Guard 
============================================================
Port      PORT         PORT                TIMER   BPDUGUARD  
NUM MLTID ADMIN_STATE  OPER_STATE TIMEOUT  COUNT   ADMIN_STATE
----------------------------------------------------------------
1/8       Up            Up        200        0       Enabled