three commands that harden spanning tree

the door nobody locks

spanning tree gets set up once, works fine, and then never gets touched again. that's the problem. the default behavior is built for compatibility, not security, which means most networks are running with an open door at layer 2 and nobody's checked the lock in years. if you can plug something into an access port and mess with the topology, so can anyone else with physical access to that port. here are three commands that close that gap, and what's actually happening under the hood.

portfast: stop waiting around

normally when a port comes up, spanning tree runs it through listening and learning states before it forwards traffic. that's 30 seconds of nothing happening, which is annoying for a laptop but also means the port is briefly vulnerable to timing based tricks during that negotiation window. portfast skips straight to forwarding on access ports.

interface range gi1/0/1 - 48
 switchport mode access
 spanning-tree portfast

this is meant for ports connecting to end devices, not switches or aps. if you put portfast on a port that's actually uplinked to another switch, you can create a loop instantly because that port skips the loop detection delay. so before you enable it everywhere, know what's actually plugged into each port.

bpduguard: the real defense

this is the one that matters most. bpdu stands for bridge protocol data unit, it's the message switches send each other to negotiate the spanning tree topology. an access port shouldn't ever see one of these, because end devices don't run spanning tree. if a bpdu shows up on an access port, that means someone plugged in an unauthorized switch, hub, or a device pretending to be one.

interface range gi1/0/1 - 48
 spanning-tree bpduguard enable

with bpduguard on, the moment that port sees a bpdu, it goes into err-disabled state and shuts down. no negotiation, no "let's see who wins," it just kills the port. this is what actually stops someone from dropping a rogue switch into a conference room jack and trying to insert themselves into your topology or run a man in the middle setup off a fake bridge.

you can also enable it globally so it applies automatically to every portfast enabled interface:

spanning-tree portfast bpduguard default

check for ports that are already down for this reason with:

show interfaces status err-disabled

that command alone will tell you if this has already saved you once and you never noticed.

root guard: protect the root bridge

every spanning tree topology has a root bridge, the switch everything else calculates its path around. if an attacker's device claims to have a better bridge priority than your real root, the whole topology can recalculate around their device, which means your traffic could start flowing through hardware you don't control. that's a full topology takeover, not just a dropped port.

root guard goes on the uplink ports facing your core or distribution switches, the ports that should never see a superior bpdu claiming root status:

interface range gi1/0/49 - 52
 spanning-tree guard root

if a superior bpdu shows up on a root guard protected port, the port goes into a root-inconsistent state instead of letting the topology shift. traffic stops on that port until the bad bpdus go away, but your actual root bridge stays put. this is the difference between "someone tried something and got blocked" and "someone tried something and now owns your network path."

where these actually go

this is the part people mess up. portfast and bpduguard belong on access ports, the ones facing printers, phones, workstations, aps. root guard belongs on uplinks and ports facing switches you don't fully trust, like a link to a different department's closet or a provider handoff. mixing these up will either break legitimate switch uplinks or leave your real attack surface unprotected. know your topology before you push config.

the takeaway

spanning tree defaults were written for a world where everyone plugging into your switch was trusted. that world doesn't exist anymore. portfast speeds up legit devices, bpduguard shuts down rogue switches the second they announce themselves, and root guard keeps your topology from being hijacked by a device claiming to be the new root. run show spanning-tree summary and show interfaces status err-disabled on your own switches today, see what's actually configured versus what you assumed was configured. three commands, applied correctly, and layer 2 stops being the soft target it's been sitting as this whole time.