BPDU Guard, Root Guard and Loop Guard: Hardening Switch Access Ports

Spanning tree keeps a switched network loop-free by trusting the information switches exchange. The guard features exist because that trust extends to any device on any port, including a consumer switch a user plugged in and a laptop running attack tooling. Each guard defends a different assumption, and applying the right one to the right port type is what the exam tests.

BPDU Guard

An access port connects an end host. An end host has no business participating in spanning tree, so a bridge protocol data unit arriving on such a port means something other than a host is attached.

BPDU Guard shuts the port down immediately — into err-disabled state — the moment any BPDU is received. Not a lower priority BPDU, not a superior one: any.

It pairs with PortFast, which skips the listening and learning states so a host gets a working link in a second rather than thirty. PortFast alone is dangerous, because a port that forwards immediately will forward a loop immediately if someone plugs a switch in. PortFast plus BPDU Guard is the standard access port configuration, and the two should be thought of as one setting.

Apply it to every user-facing port. The failure it prevents — an unmanaged switch or a home router creating a loop or hijacking the topology — is common enough that most outage post-mortems in access networks end here.

Root Guard

Root Guard protects the topology rather than the port. It is applied to ports facing other switches that should never become the root bridge — a partner's equipment, a downstream closet switch, anything outside your control.

If a superior BPDU arrives on a root-guarded port — one advertising a better bridge ID than the current root — the port moves to root-inconsistent state and stops forwarding. It does not shut down; it simply refuses to accept that device as a path to the root. When the superior BPDUs stop, the port recovers on its own.

The attack it prevents is real and easy: a device advertising a very low bridge priority wins the election and becomes the root, which redirects a large share of traffic through it. That is a machine-in-the-middle position gained without exploiting anything. Placing the root deliberately with priority values is the other half of this — covered under spanning tree priority and root bridge election — and Root Guard is what keeps your chosen root from being displaced.

Loop Guard and BPDU Filter

Loop Guard handles a subtler failure. A blocking port stays blocking because it keeps receiving BPDUs. If those stop arriving — because of a unidirectional link failure, a failing transceiver, or a software fault — the port assumes the path is gone and transitions to forwarding, creating exactly the loop spanning tree existed to prevent.

Loop Guard puts the port into loop-inconsistent state instead of forwarding when expected BPDUs disappear. Apply it on trunk and inter-switch links. Unidirectional Link Detection addresses the same class of fault at the physical layer and the two are complementary.

BPDU Filter is the dangerous one and belongs in this list mainly as a warning. It suppresses BPDUs on a port entirely — neither sending nor processing them. Used globally with PortFast it behaves relatively safely, but applied per-interface it effectively removes the port from spanning tree, and if a switch is connected there the loop forms with nothing to stop it. Do not use it as a convenience to silence BPDU Guard alerts.

Recovering an err-disabled port

A port disabled by BPDU Guard stays down until someone acts. Manual recovery is shutting and re-enabling the interface after removing the offending device.

Error-disable recovery can be configured to re-enable the port automatically after a timeout, which reduces support calls at the cost of repeatedly re-enabling a port that still has a switch on it. A moderate timeout is a reasonable compromise; instant recovery is not.

Whichever you choose, log and alert on err-disable events. A port disabling itself is a security-relevant event, and shipping switch traps and syslog into your monitoring — where they carry the usual severity levels — means somebody hears about it before the user calls.

Where to apply what

Access ports facing hosts get PortFast and BPDU Guard. Ports facing switches you do not control get Root Guard. Trunk and inter-switch links get Loop Guard, with UDLD on fibre. BPDU Filter gets used deliberately or not at all.

In data center fabrics where spanning tree has been replaced by routed underlays with overlays such as VXLAN, spanning tree usually remains enabled as a safety net at the edge — and these guards are what make that net worth having.

Exam angles

Match each guard to its threat: BPDU Guard shuts down an access port receiving any BPDU; Root Guard blocks a port advertising a superior BPDU to protect the root placement; Loop Guard prevents a blocking port from forwarding when BPDUs stop; BPDU Filter suppresses BPDUs and is risky. Know PortFast plus BPDU Guard as the standard access port pairing, err-disabled as the resulting state, and manual or timed recovery as the fix.