STP Security bpdu guard and root guard
BPDU Guard is a feature that defends the Layer 2 Spanning Tree Protocol (STP) topology -
against BPDU-related threats and is designed to protect the switching network.The BPDU guard feature must be activated on ports that should not receive BPDUs from connected devices
Root guard forces a port to be always designated as the root port.
Loop guard is effective only if the port is a root port or an alternate port.
You cannot enable loop guard and root guard on a port at the same time
Loop guard has no effect on a disabled spanning tree instance or a VLAN
The BPDU guard feature can be globally enabled on the switch or can be enabled per interface, but the feature operates with some differences. At the global level, you enable BPDU guard on Port Fast-enabled STP ports by using the spanning-tree portfast bpduguard default global configuration command