In enterprise networking, firewalls and antivirus software alone aren't enough — at Layer 2, you need silent but critical layers of protection. If you've ever dealt with loops, IP conflicts from rogue DHCP, or users plugging in their own switches or Wi-Fi routers, this article is for you.
BPDU Guard – Block Unauthorized Devices
About BPDU: Bridge Protocol Data Unit (BPDU) packets are used in the Spanning Tree Protocol (STP) to negotiate topology between switches.
1. Objective of BPDU Guard
- Prevent unauthorized devices (e.g., unmanaged or rogue switches) from sending BPDUs and participating in STP.
- Avoid scenarios where employees plug in a mini switch to a wall jack and it sends BPDUs, affecting the STP topology and causing loops.
- BPDU Guard ensures Access ports do not accept BPDUs — any BPDU triggers immediate port shutdown.
2. How It Works
- When PortFast or admin-edge-port is enabled, the port is assumed to connect to an endpoint device and should not receive BPDUs.
- If a BPDU is received (maliciously or accidentally): Cisco: port is disabled via err-disable. ICX/Brocade: same behavior.
- This prevents rogue switches from joining and avoids root bridge changes or L2 loops.
⚠️ Without BPDU Guard, PortFast will still allow BPDU with no protection!
3. Configuration
Switch# configure terminal
Switch(config)# interface fastEthernet 0/1
Switch(config-if)# spanning-tree bpduguard enable
# Range
Switch(config)# interface range fastEthernet 0/1 - 10
Switch(config-if-range)# spanning-tree bpduguard enable
# Enable recovery (optional)
Switch(config)# errdisable recovery cause bpduguard
Switch(config)# errdisable recovery interval 400
device# configure terminal
device(config)# interface ethernet 1/1/1
device(config-if)# stp-bpdu-guard
# Range
device(config)# interface ethernet 1/1/1 to 1/1/9
device(config-mif)# stp-bpdu-guard
# Enable recovery
device(config)# errdisable recovery cause bpduguard
device(config)# errdisable recovery interval 120
DHCP Snooping – Eliminate Rogue DHCP, Keep IP Clean
1. Objective
Block unauthorized (rogue) DHCP servers from assigning IP addresses.
- Only trusted ports can send DHCP OFFER / ACK.
- Prevent clients from getting wrong IPs, fake gateways, or DNS → avoids MITM attacks.
- Build a binding table of IP ⇄ MAC ⇄ VLAN ⇄ Port → useful for features like DAI.
Rogue DHCP attacks involve a malicious actor running a fake DHCP server to intercept traffic (MITM).
2. How It Works
- Ports are marked as trusted or untrusted.
- Trusted: allowed to send DHCP OFFER/ACK.
- Untrusted: only allowed DHCP DISCOVER/REQUEST.
- DHCP replies on untrusted ports are dropped.
3. Configuration
switch(config)# ip dhcp snooping
switch(config)# ip dhcp snooping vlan 10,20
switch(config)# interface FastEthernet0/24
switch(config-if)# ip dhcp snooping trust
device(config)# ip dhcp snooping
device(config)# interface ethernet 1/1/48
device(config-if)# ip dhcp snooping trust
Loop Detection – Detect Layer 2 Loops
1. Objective
- Detect and block Layer 2 loops that can cause broadcast storms, high CPU load, and network outages.
- Supplement or replace STP in environments where STP is not used or insufficient.
- Automatically shut down or log offending ports.
2. How It Works
Loop detection logic:
Switch sends test frames; if they come back, a loop exists.
It can then log, shut down the port, or trigger SNMP/Syslog traps.
3. Configuration
Switch(config)# interface fastEthernet 0/1
Switch(config-if)# loopdetect
device(config)# interface ethernet 1/1/1
device(config-if)# loop-detection
device(config)# vlan 10
device(config-vlan)# loop-detection
# Global settings
device(config)# loop-detection-interval 50
device(config)# errdisable recovery cause loop-detection
device(config)# errdisable recovery interval 120
device# show loop-detection status
device# show loop-detection disable
device# show loop-detection resource
Spanning Tree & Admin-Edge-Port vs PortFast
1. Objective
- Speed up port forwarding when connecting endpoint devices like PCs, phones, printers.
- Avoid delay from STP states (Listening → Learning → Forwarding).
- To be used only on access ports, not uplinks.
⚠️ PortFast does not prevent loops. Use BPDU Guard alongside.
2. How It Works
- Skips STP states → port goes to forwarding immediately.
- Vital for DHCP, VoIP, PXE boot, etc.
3. Configuration
interface FastEthernet0/1
switchport mode access
spanning-tree portfast
interface ethernet 1/1/1
spanning-tree 802-1w admin-edge-port
Explanation:
- 802-1w: uses Rapid STP
- admin-edge-port: like PortFast – skips STP negotiation
Layer 2 Security FAQ
PortFast / Admin-Edge-Port
- Purpose: Speed up port forwarding for endpoint devices
- Prevent loops? No. Use with BPDU Guard.
BPDU Guard
- When to enable? With PortFast/admin-edge-port
- Reaction? Port goes err-disable on BPDU detection
DHCP Snooping
- Purpose: Block rogue DHCP, log IP–MAC
- Trusted ports: Only those connected to real DHCP server
- Untrusted: All user access ports
Loop Detection
- Where to enable? Access ports only
- Trunk ports? Avoid – may disable uplinks accidentally
- Can it replace STP? No, just supplements it
