Spanning-Tree Portfast – The Definitive Guide

The spanning-tree portfast command is a very simple feature but often mis-understood.
In this short post I will explore how this feature behaves, how it works and how to configure it on a cisco switch.
Portfast is a Cisco Propietary feature that was originally developed to overcome an issue when a PC was trying to obtain a DHCP address and going past the DHCP process before the port had gone into a forwarding state. The portfast feature brought the port into a forwarding state as soon as it came up enabling the PC to obtain a DHCP address. The feature was then standardised and is now called the Edge port.

This is the main point to be remembered.

An interface that has portfast configured on it will skip the listening and learning phases of spanning tree but only when the interface comes up.

Configuring Spanning Tree Portfast

There are two ways of configuring portfast globally and per interface.

In both cases these features are conditional upon incoming BPDUs

If portfast is configured on a port and it receives a BPDU the port will disable the portfast feature.

Another mis-conception is that when portfast is enabled on a port that it will stop sending BPDUs, this is not true the only thing that enabling portfast on a cisco switch does is to disable the listening and learning phases, all other elements are still there. BPDUs will still be sent and BPDUs being received will be processed.

Interface Configuration

To configure an interface with portfast, under the interface configuration simply enter the command spanning-tree portfast
you will receive a warning which I will explain later.

When configuring per-interface you also have the option to configure trunk mode.

This will also enable portfast on trunk links also.

Global Configuration

To configure portfast globally under global configuration mode enter the command spanning-tree portfast default

This will enable portfast on all operational access ports.

Now this is how you actually configure it, but you also have to be very aware of the operational portfast status of a port. Other features depend on the operational status of portfast for correct operation. One of these is bpduguard.

If configured globally bpduguard will only take effect on ports that have their ports in a portfast operational status.

Irrespective of the configuration on a port the command below will show you the actual portfast operational status.

If we show the configuration on this port you will see that we have actually configured portfast

So why is it disabled? The reason is because the other end of fa0/23 is connected to SW2 the port has received a BPDU and disabled the portfast status

So if we tried to enable bpduguard globally this would  have no effect at all as the portfast status is disabled. This is what we want as if this was an access port and not connected to a switch it would not be receiving BPDUs and thus the portfast status would be enabled. Then when enabling bpduguard it would be operational and be ready to shut down the port if it received any BPDUs on that port indicating that someone had connected a switch to an access port.

BPDU Guard – any received BPDU will cause the port to go into err-disabled state.

Another  feature that interacts with the operational portfast status of a port is BPDU Filter 

The video below from Marco explains the interaction better than I can.