From the net: CCNA Basics: What is BPDU GUARD ?

 I thought you would find the article, “CCNA Basics: What is BPDU Guard?” from The Network DNA interesting.

BPDU Guard is a security feature in Cisco switches designed to protect a network’s Spanning Tree Protocol (STP) topology, especially on user-facing or edge ports. When PortFast is enabled to allow rapid transition into the forwarding state, unexpected BPDUs (Bridge Protocol Data Units)—which typically should not appear on access ports connected to end devices—can indicate a misconfiguration or unauthorized switch connection. If BPDU Guard is enabled and a BPDU is received on such a port, the port is immediately disabled (placed in an error-disabled state), effectively denying any device connected behind it from participating in STP. This requires manual re-enabling of the port or configuring an error-disable timeout for automatic recovery

The feature is particularly useful for preventing rogue switch connections and safeguarding network integrity by enforcing strict boundaries around the STP domain. There are two main ways to activate BPDU Guard: globally—by enabling it by default on all PortFast-enabled ports using the spanning-tree portfast bpduguard default command—or on a per-interface basis using the spanning-tree bpduguard enable command. This configurability allows administrators to secure access-layer ports while maintaining flexibility for expected switch links