Question

How does BPDU guard provide protection?

a. All firewalls are configured to let BPDUs pass to the external network.
b. BPDUs are encrypted so that attackers cannot see their contents.
c. It sends BPDU updates to all routers.
d. It detects when a BPDU is received from an endpoint.

Answer 1

BPDU Guard enhances network security by automatically disabling switch ports that receive BPDUs on what are supposed to be edge ports, thus preventing potential network loops and STP topology changes from rogue or misconfigured devices.

Step-by-step explanation:

BPDU Guard provides protection in a network by detecting when a Bridge Protocol Data Unit (BPDU) is received on a port that is configured as an edge port, typically where an endpoint device such as a computer or printer is connected. When BPDU Guard is enabled on a switch port and it receives a BPDU, it puts the port into an error-disabled state, preventing potential loops in the network that could be caused by the unexpected appearance of switch infrastructure on a port that was designated for non-switch devices.

This error-disabled state essentially shuts down the port, stopping all traffic, thus mitigating the possibility of a rogue switch or a device configured to generate BPDUs from causing network issues. This is particularly important in preventing Spanning Tree Protocol (STP) topology changes caused by an unauthorized or misconfigured device. In summary, BPDU Guard is a security feature to ensure the stability of the network's switch-based STP topology.