EX Switches provide Layer 2 loop prevention through Spanning Tree Protocol (STP), Rapid Spanning Tree protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP). BPDU protection is configured on non-STP interfaces that are connected to switches with spanning tree to prevent the non-STP interfaces from receiving BPDUs. When non-STP interfaces receive BPDUs, it can result in an STP misconfiguration, which could lead to network outages.

A loop-free network is supported through the exchange of a special type of frame called "bridge protocol data unit"(BPDU). Receipt of BPDUs on certain interfaces can lead to network outages by triggering an STP miscalculation. Enable BPDU protection on those interfaces that should not receive BPDUs.

Enable BPDU protection on interfaces on which BPDUs are NOT expected, such as access ports connected to user devices. If BPDUs are received on a BPDU-protected interface, the interface transitions to a blocking state and stops forwarding frames.

Caution: When configuring BPDU protection on a non-STP configured switch connected to an STP-configured switch, be careful that you do not configure BPDU protection on all interfaces. Doing so could prevent BPDUs being received on interfaces (such as a trunk interface) that should be receiving BPDUs from an STP-configured switch.

Let's consider that two ports ge-0/0/5 and ge-0/0/6 are not running any spanning tree protocol and these ports are connected to PCs (end hosts). The PCs are not supposed to send spanning tree BPDUs. The BPDU protection can be configured on these non-STP ports by executing the following commands in CLI

To check the results of the configuration:

Before the BPDUs are recieved on these interfaces these interfaces will not be blocked and will forward user traffic:

Now, lets assume that the PCs connected to ge-0/0/5 and ge-0/0/6 start sending STP BPDUs. Since the bpdu block is enabled on these interfaces, the reception of BPDUs on these interfaces triggers the BPDU protection feature and puts these ports into blocking mode:

user@switch> show ethernet-switching interfaces

Interface State VLAN members Blocking
ge-0/0/0.0 up default unblocked
ge-0/0/1.0 up default unblocked
ge-0/0/2.0 up default unblocked
ge-0/0/3.0 up default unblocked
ge-0/0/4.0 up v1 unblocked
ge-0/0/5.0 down v1 blocked - blocked by bpdu-control
ge-0/0/6.0 down default blocked - blocked by bpdu-control
[output truncated]

When BPDUs are sent from the PCs to interface ge-0/0/5.0 and interface ge-0/0/6.0 on the Switch, the output from the operational mode command show spanning-tree interface shows that the interfaces have transitioned to a BPDU inconsistent state. The BPDU inconsistent state makes the interfaces shut down and prevents them from forwarding traffic.

Thus BPDU protection can be configured on non STP interfaces of a switch to protect the switch from causing unwanted spanning tree misconfiguration when it recieves a BPDU on access ports.

Recovery:

BPDU error recovery can be performed manually or dynamically by using a pre-defined configuration.

The command used to manually recover the BPDU error is as follows:

{master:0}[edit]
user@switch# run clear ethernet-switching bpdu-error 

OR

This error can also be dynamically recovered by using the following configuration:

{master:0}[edit]
user@switch # show ethernet-switching-options 
bpdu-block {
   disable-timeout 10;
}

2019-10-30: Added recovery steps.

• EX Switches - How to configure root protection to enforce root bridge placement in Spanning Tree
• How to add Loop Protection to Prevent Interfaces from Transitioning from Blocking to Forwarding in a Spanning Tree on EX Series Switches [juniper.net]
• How to unblock an interface which is blocked due to BPDU protection [juniper.net]