Spanning Tree PortFast: Faster Access Ports, Safely

PortFast is a small spanning tree feature with an outsized practical effect: it is the difference between a host getting an IP address the instant it plugs in and a host sitting dark for thirty seconds while STP makes up its mind. It is also one of the easiest features to misapply in a way that takes down a network. This post explains what PortFast does, where it belongs, where it absolutely does not, and the two guard features that keep it safe.

For the cluster overview, see the Spanning Tree Protocol complete guide.

The problem PortFast solves

When a port comes up, classic 802.1D spanning tree walks it through Listening and Learning before Forwarding - 15 seconds in each, 30 seconds total. STP does this so a newly active port cannot instantly create a bridging loop.

For a link to another switch, that caution is correct. For an access port with a single PC, printer, or server on it, it is pure dead time. Thirty seconds of silence is long enough that a DHCP client gives up, a PXE boot fails, or a server's network stack flags the interface as down. The classic symptom is "the laptop never gets an IP on a fresh boot but works fine after a reconnect."

What PortFast does

PortFast tells the switch a port is an edge port - a port with an end device on it, not another switch. An edge port skips Listening and Learning and goes straight to Forwarding the moment it links up. The host gets immediate connectivity.

PortFast does not disable spanning tree on the port. STP still runs; the port can still receive and process BPDUs. PortFast only changes the startup transition. In Rapid PVST+ the same idea is built in as the "edge port" concept, and PortFast is how you mark a port as edge.

Where PortFast belongs - and where it does not

The rule is simple and absolute: PortFast goes on access ports that connect to end devices only. Never on a port that connects to another switch, bridge, or hub.

The reason is the loop. A PortFast port jumps to Forwarding instantly. If someone plugs a switch into that port, you have a forwarding path that bypassed the Listening/Learning safety window - a bridging loop forms before STP can react, and a loop can saturate a LAN in seconds. PortFast on the wrong port is one of the faster ways to melt a network.

BPDU Guard: the safety net

Because a PortFast port should only ever face an end device, it should never receive a BPDU - end devices do not send them. BPDU Guard enforces that assumption. If a PortFast port with BPDU Guard enabled receives any BPDU, the switch immediately puts the port into err-disabled state, shutting it down.

That is exactly the behavior you want. Someone plugged a switch into a user port? The port shuts before a loop can form, instead of after. BPDU Guard turns "PortFast on the wrong port" from an outage into a single dead port and a log message.

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi0/5 with BPDU Guard
  enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi0/5, putting Gi0/5
  in err-disable state

BPDU Filter: handle with care

BPDU Filter stops a port from sending and processing BPDUs at all. It is occasionally used at a demarcation to a customer or third party so your STP domain does not extend into theirs.

It is dangerous when enabled globally for PortFast ports, because a filtered port that is silently bridged into another switch has neither STP nor BPDU Guard watching it - the exact loop PortFast risks, with the safety net removed. Treat BPDU Filter as a deliberate per-interface tool, not a default. For ordinary access ports, use BPDU Guard, not BPDU Filter.

Configuration on Cisco IOS XE

Two ways to apply PortFast. Per interface, on a known access port:

interface GigabitEthernet0/5
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpduguard enable

Or globally, which is the recommended pattern - it applies PortFast and BPDU Guard to every port that operates as an access port, without touching trunks:

spanning-tree portfast default
spanning-tree portfast bpduguard default

With the global form, you configure the pair once and every new access port is protected automatically. Recovery from err-disable can be automated:

errdisable recovery cause bpduguard
errdisable recovery interval 300

Verifying

SW1# show spanning-tree interface Gi0/5 portfast
VLAN0010            enabled

SW1# show spanning-tree summary
Portfast Default        is enabled
PortFast BPDU Guard Default  is enabled

Common gotchas

Key takeaways

PortFast sends an access port straight to Forwarding instead of through the 30-second Listening and Learning delay, which is what lets a host get an address the moment it connects. It belongs on access ports facing end devices only and never on switch-to-switch links, because an instant-forwarding port can create a bridging loop. Always pair PortFast with BPDU Guard: a PortFast port should never see a BPDU, and BPDU Guard err-disables it the instant one arrives, turning a potential outage into one dead port. The cleanest deployment is the global default form, which protects every access port automatically.

For the STP cluster, see the Spanning Tree pillar.