BPDU Guard shut the port: something switch-like appeared on an access port
%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port GigabitEthernet1/0/5 with BPDU Guard enabled. Keeping interface in errdisable state
In plain English: BPDU Guard is a tripwire on ports meant for end devices — PCs, phones, printers.
Platform: Cisco IOS / IOS XE. Values shown are the documented defaults — confirm them on your platform with the check commands below.
What it means
BPDU Guard is a tripwire on ports meant for end devices — PCs, phones, printers. If such a port receives a spanning-tree message (a BPDU), the kind of message only switches send, the switch assumes something switch-like was plugged in where it does not belong and shuts the port immediately. It exists because one rogue switch, or one looped cable, on an access port can destabilize the whole LAN.
Likely causes, in order
Someone plugged in a small unmanaged switch or hub to get more ports at a desk — the most common cause.
A cable was looped: both ends of one lead plugged into the same switch, or two wall jacks patched together.
An IP phone or another device with a built-in switch was mis-cabled, passing BPDUs through.
A legitimate switch was connected during office work without telling the network team, on a port that was never converted to a trunk.
Check, in order
show interfaces status err-disabledConfirms this port and shows whether others shut at the same time — a pattern points at rack or office work rather than one desk.
show mac address-table interface Gi1/0/5How many devices sit behind the port. Many MAC addresses means a switch or hub is down there.
show cdp neighbors Gi1/0/5 detailIf the device beyond speaks CDP, this names it — it often identifies itself as a switch outright.
The fix
Find and remove the unauthorized switch or the loop, then re-enable the port with shut / no shut.
If the connected switch is legitimate and approved, convert the port to a proper trunk as a planned change and remove BPDU Guard from it — trunks are where switches belong.
Do not respond by disabling BPDU Guard globally. The next rogue switch will not announce itself; it will take the LAN down at spanning-tree speed.
Did this fix it for you? One tap — anonymous, nothing to type, and nothing you send is ever published.
Thanks — your tap helps the next engineer. A run of "still broken" reports sends this page back to the top of our re-check list.
Full case: this error is one stop in a bigger fault. Work the complete playbook: Port Keeps Going Err-Disabled — checks, ranked causes, the fix, and verification.