NacTrack
FRGet the demo
Spanning tree

How to check whether BPDU Guard is enabled on edge ports

BPDU Guard shuts a port down the moment a switch appears where only endpoints should be, which is what stops someone plugging a desk switch into a wall socket and rearranging your spanning tree. NacTrack does not read it from live state; it checks the running configuration against a benchmark rule, so the question is answered on the Compliance page rather than the STP one.

All the questions
The same procedure as a recording, subtitled in English and French. This recording predates the latest revision of the steps: it opens on a screen the written guide no longer includes.
Before you start

What you need

  • Module required: compliance.
  • Permission required: view_audit.
  • Aruba AOS-CX, Cisco NX-OS and Dell OS10 only

1. Open Security then Compliance

app.nactrack.com/compliance/report
Open Security then Compliance
Open Security and choose Compliance. It opens on Overview, which is the fleet summary: the posture across every device, not the detail of any one of them.

2. Switch to the Devices tab

app.nactrack.com/compliance/report
Switch to the Devices tab
Switch to the Devices tab. Now every evaluated device is listed with its score and the number of checks that ran against it. The count beside the tab name tells you how many before you click.

3. Open a device result

app.nactrack.com/compliance/report
Open a device result
Open a device to see its individual checks. The BPDU Guard rule appears by name among them, passed or failed, with the configuration line that decided it. That line is the evidence you would take to a change request.
The limits

What this view does not tell you

  • Only three rules cover BPDU Guard, one each for Aruba AOS-CX, Cisco NX-OS and Dell OS10. A Cisco IOS or IOS-XE access switch is not checked for it at all, so a passing score does not mean the whole edge is protected.
  • Compliance reads configuration text. It can tell you the command is present; it cannot tell you the port ever actually blocked anything.
  • Root Guard is a different feature and NacTrack does not check it anywhere. Do not read a BPDU Guard pass as covering it.

Try the same thing on your own estate

Request accessAll the questionsEvery guide as a PDF (25 MB)