Troubleshooting

BPDU Guard Err-Disabled a Port

VSVipul Sir · 6 min readLast updated: 22 July 2026

BPDU Guard shuts a port down the moment it receives a BPDU. Because BPDUs only come from switches, this means a switch was plugged into a port meant for an end device. The port goes err-disabled and stays down until manually recovered or an auto-recovery timer expires.

What you see

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port GigabitEthernet1/0/5 with BPDU Guard
  enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/5, putting Gi1/0/5 in err-disable state

Why it happens

PortFast lets an access port skip STP's listening and learning states so devices get connectivity instantly. That is safe only if nothing that speaks STP is ever connected there. BPDU Guard enforces that promise: receive one BPDU and the port is disabled immediately.

So this error is doing its job. Someone connected a switch, a hub with STP, or a virtualisation host bridging BPDUs, into a user-facing access port. Left unguarded, that connection could have created a loop and taken the network down.

How to confirm it

show interfaces status err-disabled
show errdisable recovery
show logging | include BPDUGUARD|ERR_DISABLE
show spanning-tree interface GigabitEthernet1/0/5 detail

show interfaces status err-disabled lists every disabled port and the reason. Do not just re-enable — find out what was plugged in.

The fix

! Manual recovery, after removing the offending device
interface GigabitEthernet1/0/5
 shutdown
 no shutdown
!
! Optional: recover automatically after 5 minutes
errdisable recovery cause bpduguard
errdisable recovery interval 300

Automatic recovery is convenient but hides the underlying cause — if the rogue switch is still connected, the port will simply flap every interval. Remove the device first.

How to stop it happening again

Apply spanning-tree portfast and spanning-tree bpduguard enable to every access port as standard, and never to switch-to-switch links.

Questions people ask

Why did my port shut down when I plugged in a switch?

Because BPDU Guard is working as designed. Access ports with PortFast are not allowed to see BPDUs, and receiving one indicates a potential loop, so the port is disabled to protect the network.

How long does err-disable last?

Indefinitely unless you recover it manually with shutdown/no shutdown, or configure errdisable recovery with an interval (minimum 30 seconds).

Reading the fix is not the same as doing it

Every fault on this page can be broken and repaired on real Cisco routers and switches in our Ahmedabad lab — which is how it stops being theory. Come and see the rack before you pay anything.