BPDU Filter vs. BPDU Guard: What Is the Difference?
Both BPDU Filter and BPDU Guard are Spanning Tree Protocol features used to control how switch ports handle Bridge Protocol Data Units, commonly called BPDUs. BPDUs are messages exchanged between switches so STP can detect Layer 2 topology changes, elect the root bridge, and prevent switching loops.
Although the names sound similar, BPDU Filter and BPDU Guard serve very different purposes. BPDU Guard is a protection mechanism. BPDU Filter is a suppression mechanism. Understanding the difference is important because misusing BPDU Filter can create a serious loop risk.
What Is BPDU Guard?
BPDU Guard is used to protect edge ports from receiving unexpected BPDUs. It is most commonly used on access ports that connect to end-user devices such as PCs, printers, phones, cameras, or other non-switch devices.
The logic is simple: if a port is configured as an edge port using PortFast, it should not receive BPDUs. If it does receive a BPDU, that usually means someone connected a switch, bridge, or another Layer 2 device where one was not expected.
When BPDU Guard is enabled and the port receives a BPDU, the switch places the interface into an errdisabled state. This shuts down the port from a Layer 2 forwarding perspective and protects the STP topology from being affected by an unauthorized or misconnected device.
BPDU Guard Use Case
BPDU Guard is typically used on user-facing access ports. For example, if someone plugs a small unmanaged switch into a cubicle port, BPDU Guard can shut down that port before the device can impact the spanning-tree topology.
For most enterprise access-layer designs, PortFast plus BPDU Guard is the preferred configuration for host-facing ports.
What Is BPDU Filter?
BPDU Filter is used to suppress BPDUs. However, its behavior depends heavily on how it is configured. This is the most important distinction.
BPDU Filter can be configured in two ways:
- Globally with PortFast
- Directly on an interface
These two methods do not behave the same way.
Global BPDU Filter with PortFast
Global BPDU Filter is configured with the following command:
Switch(config)# spanning-tree portfast bpdufilter default
When BPDU Filter is enabled globally, it applies only to ports that are operating as PortFast edge ports. In this mode, the switch suppresses BPDUs while the port is acting as an edge port.
If the port receives a BPDU, the port loses its PortFast operational status, BPDU Filter is removed from that port, and the port begins participating in STP. This makes global BPDU Filter less risky than enabling BPDU Filter directly on an interface.
Global BPDU Filter is sometimes used when you do not want host-facing ports to send BPDUs toward end devices. However, it should still be used carefully and only when there is a clear design requirement.
Interface-Level BPDU Filter
Interface-level BPDU Filter is configured directly under the interface:
Switch(config)# interface FastEthernet0/1 Switch(config-if)# spanning-tree bpdufilter enable
This is the more dangerous form of BPDU Filter.
When BPDU Filter is enabled directly on an interface, the switch does not send BPDUs out that port and does not process received BPDUs on that port. In other words, STP is effectively blind on that link.
If a downstream switch, unmanaged switch, or accidental loop exists beyond that port, STP may not be able to detect or block the loop. This can lead to a Layer 2 loop, broadcast storm, MAC table instability, and network outage.
BPDU Guard vs. BPDU Filter
| Feature | Purpose | Behavior When BPDU Is Received | Common Use Case | Risk Level |
|---|---|---|---|---|
| BPDU Guard | Protects edge ports from unexpected BPDUs | Errdisables the port | User-facing access ports with PortFast | Low |
| Global BPDU Filter | Suppresses BPDUs on PortFast-enabled ports | Port loses PortFast behavior and participates in STP | Specific edge-port designs where BPDUs should not be sent to hosts | Moderate |
| Interface BPDU Filter | Suppresses sending and receiving BPDUs on a specific interface | BPDU is ignored and the port does not participate normally in STP | Rare, specific designs where STP must intentionally be suppressed | High |
Configuration Examples
Enable BPDU Guard on a Specific Interface
Switch(config)# interface FastEthernet0/1 Switch(config-if)# spanning-tree bpduguard enable Switch(config-if)# exit
Enable BPDU Guard Globally for PortFast Ports
Switch(config)# spanning-tree portfast bpduguard default Switch(config)# exit
Enable BPDU Filter on a Specific Interface
Switch(config)# interface FastEthernet0/1 Switch(config-if)# spanning-tree bpdufilter enable Switch(config-if)# exit
Enable BPDU Filter Globally for PortFast Ports
Switch(config)# spanning-tree portfast bpdufilter default Switch(config)# exit
Recommended Design Guidance
For standard enterprise access ports, the recommended approach is usually to enable PortFast and BPDU Guard. This allows end-user ports to transition to forwarding quickly while still protecting the network if a switch is accidentally or intentionally connected.
Switch(config)# spanning-tree portfast default Switch(config)# spanning-tree portfast bpduguard default
BPDU Filter should be used much more carefully. Global BPDU Filter has some safety behavior because it applies to PortFast ports and stops filtering if a BPDU is received. Interface-level BPDU Filter is much riskier because it prevents the switch from sending or processing BPDUs on that interface.
Summary
BPDU Guard and BPDU Filter are not interchangeable. BPDU Guard is a protective feature that shuts down a PortFast edge port if it receives a BPDU. It is commonly used to prevent unauthorized switches from affecting the STP topology.
BPDU Filter suppresses BPDUs, but its behavior depends on how it is configured. Global BPDU Filter applies to PortFast-enabled ports and can stop filtering if a BPDU is received. Interface-level BPDU Filter is more dangerous because the port does not send or process BPDUs, which can remove STP protection from the link.
In most environments, use BPDU Guard on edge ports. Use BPDU Filter only when there is a specific design requirement and the loop-prevention impact is fully understood.