BPDU Guard puts the port in ERR-DISABLED when a BPDU is received.

Where it’s used

Access ports with PortFast – prevents someone from attaching a switch to the access layer.

Traps ⚠️

• Useless without PortFast
• Must not be used on uplinks

CLI

Per interface:

interface Gi0/1
 spanning-tree bpduguard enable

Global (on all PortFast ports):

spanning-tree bpduguard default

Status / control:

show spanning-tree inconsistentports
show errdisable recovery

Recovery

errdisable recovery cause bpduguard
errdisable recovery interval 300
! or: shutdown + no shutdown