STP Edge Port: Missing BPDU Guard
An edge port has PortFast but no loop protection paired with it. Diagnose the gap and fix it yourself, live, right below.
Learn root election and port roles in the spanning tree lab guideSymptom
An access port is configured for fast startup but has no loop protection. Apply the right edge safeguards and verify the operational state.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: SW-ACC
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
A user-facing access port is enabled for PortFast without BPDU Guard. A small unmanaged switch is connected, creating a path that could introduce an unintended Layer 2 loop.
What you'll practice
- Read STP port roles and edge state
- Explain PortFast
- Apply BPDU Guard to an edge port
- Verify protective state
The topology
An access switch has user ports and one uplink; the fault is isolated to a user-facing edge port.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show spanning-tree interface Ethernet0/1 detailshow running-config interface Ethernet0/1Frequently asked
Isn't PortFast enough on its own?
PortFast only controls how fast the port starts forwarding. It says nothing about what happens if that port ever receives a BPDU, which a genuine edge device should never send. BPDU Guard is the safeguard that reacts to that case.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.