BPDUGuard vs. BPDUFilter

We all know that Spanning-Tree uses BPDU to communicate link state and configuration changes within a Switched network.  Spanning-Tree will use 2 types of BPDU's:

1. TCN BPDU - will be used to notify other switches of changes occuring
2. Configuration BPDU - will be used for the spanning-tree computations

The main goal of the BPDU's is to assist in maintaining information regarding the link state of neighboring switches so that a loop free switched network can be maintained.  The BPDU's help create the best reference point called the root bridge and helps create alternate pathing in case a link goes down.

So we know that switch ports connected to other switch ports will send each other BPDUs in order to assist spanning-tree, and the those switched ports will use the stp timers ( 2 sec hellos, 15 listening, 15 learning, 20 sec max age).  Given the timers of spanning-tree it could take up to 50 seconds to recover from any link failures.

In order to bypass this 50 second delay, we can configure the switch to bypass the listen, learning, and max age timer by putting the interfaces in portfast mode.

Portfast mode should be used when end devices such as servers, router, and pc's are connecting to the switch.  Spanning-tree is not necessary when connecting to such devices, only necessary when connecting switches to switches.

So why do we need BPDUGuard and BPDUFilter?

Well, what if we assigned a port to a user thinking he/she would plug in their pc, but instead they plugged in their Cisco swith they bought off of Ebay.  That switch would immediately beging sending BPDU's to the other network switches.

Given that the root bridge switch is determined by a combination of both (port priority + mac address) called the bridge ID, this new switch could win the root election thus altering all of the switching behaviour of the entire network....not good.

To prevent such unexpected mayheim, you can configure BPDUGuard or BPDUfilter on those ports that have been set as portfast ports.

BPDUGuard will watch out for BPDU's on configured ports and if it senses any BPDU's, it will shut the port down and put it in errdisable status so that there is no way any new unathorized switch can begin sending BPDU's to the switch network and participation in spanning-tree.

BPDUFilter is very similar to BPDUGuard in that it watches for BPDU's but rather than shutting down the port it merely ignores the BPDU's and filters them out rather than shutting down the port and putting the port in errdisable.

BPDUGuard - shut ports down and puts ports in errdisable if it senses BPDU's
BPDUFilter - does not shut down port or put in errdisable but instead just filters (ignores) BPDU's

802.1w - Spanning-Tree

802.1w know as Rapid Spanning-Tree is a great improvement over 802.1d Spanning-Tree.  802.1w operates with the same principle of Spanning-Tree however the convergence time is dramatically faster.

Another added benefit of 802.1w(Rapid Spanning-Tree) is the fact that single or multiple instances can be applied.  This can be done by applying RSTP with the Cisco proprietary PVST+ forming what's called RPVST+.

Just like 802.1d(Spanning-Tree) 802.1w(Rapid Spanning-Tree) chooses the Root Bridge based on the lowest Bridge ID.

Rapid Spaning-Tree Port Roles

• Root Port -  one port on each switch with best Root Path Cost to the Root Bridge
• Designated Port - ports on the Root Bridge
• Alternate Port - a different less desirable path to the Root Bridge and not the same as the Root Port
• Backup Port - a port that creates a redundant path to an already connected segment

Spanning-Tree Root Bridge

Spanning Tree Root Bridge

As soon as the switch powers up it first assumes that it is the Root Bridge. The Spanning Tree election process begins quickly given that BPDU's are sent out every 2 seconds.  Every switch begins sending out BPDU's with a Root Bridge ID equal to it's own Bridge ID and a Sender Bridge ID that is its own Bridge ID. The purpose of the sender ID is to inform the other switches who is actually the sender of the BPDU message.

Each BPDU will be checked to see if it has a lower Root Bridge ID. If the BPDU is lower than the current switches BPDU, the current switch will then replace its own Root Bridge ID with the newly announced Root Bridge ID.  If the Root Bridge ID is not lower then it will simply just forward the BPDU without making any changes.

As soon as the root bridge is determined, then configuration BPDU's will only be sent by the Root Bridge. The other switches must forward or relay the BPDU's while adding their own Sender Bridge ID to the message.

Bridge Protocol Data Unit - BPDU

In order for Spanning-Tree to operate, Bridge Protocol Data Units (BPDU) are used to communicate between all switches.  Switches must learn of other switches in the network. This is accomplished by each switch sending a BPDU frame out a port and using a unique MAC address of that particular port as the "source address".  Given that the switch is unaware of other switches in the network, BPDU's are sent with a "destination address" of the STP multicast address 01-80-c2-00-00-00.

The 2 Types of BPDUs are:

1. Configuration BPDU
2. Topology Change Notification (TCN) BPDU

The 2 Goals of BPDU's are:

1. Elects reference points as the foundation for a stable spanning-tree topology.
2. Helps spanning-tree communicate topological changes to deal with loops and faults in the switched network.
   

Configuration BPDU are used to compute spanning-tree.  It is how the switches in the network agree on which switch will be the root bridge.  The BPDU's are pass amongst each switch every 2 seconds.  Once the root bridge is determined spanning-tree uses BPDU's to communicate topological changes such as links going down and coming back up.

802.1d - Spanning Tree

All Networks should be designed to primarily accomplish 2 things.

1. Efficiently transfer packets or frames.
2. Provide recoverability from faults in the Network.

To accomplish this goal, routing protocols are used in layer 3(routers).  Layer 3 routing accomodates multiple paths to a network destination to be up and "active" while providing load sharing across those multiple paths.

In contrast, layer 2(switches) does not use routing protocols and active redundant paths.  In fact active redundant paths are not allowed nor desirable.  The question can be asked "How does layer 2 handle redundancy and fault tolerance".  The answer is that Layer 2 uses Spanning-Tree (STP) for its network link redundancy.  Spanning-Tree provides links redundancy so that a switched network can recover from faults without having to provide direct intervention from Network Engineers.  STP is also known as IEEE 802.1d standard.

As Network Engineers we can use Spanning-Tree to avoid bridging loops.  A bridging loop is when a single frame is forwarded back and forth between 2 switches.  This endless loop of forwarding creates unbearable network congestion.  These loops form because the layer 2 devices are unaware of each other.

Spanning-Tree (802.1d) was created to eliminate the possibility of bridging loops while using redundant swithches and swithch paths.  Primarily STP (802.1d) enables all the switches to know of each other so they can negotiate a loop free network.

STP simply discovers all loops in the switched network and then shut downs redundant links before they are made available.  STP informs switches when shut down links should be brought up in order to fix faults in the network.  All connected switches will communicate via STP.  Every switch will run the STP algorithm based on all the information that they receive from the neighboring switches.  STP will create a root bridge and then calculate all redundant links to that root bridge.  Once the redundant paths are known and calculated, STP will choose the best path with the least cost and then begin forwarding frame along that path.  STP will disable and or block forwarding on all of the other redundant paths.

In summary STP creates communication between switches, discovers redundant paths, calculates best single path, blocks and or disables redundant paths, and enable blocked and or disable during network failure to maintain fault tolerance.