Quick question on the most secure way to protect your network. I didn't realise until I watched Brians video on this topic, but when configuring BPDU filter in global config it only blocks BPDUs from being sent outbound (i.e. no filtering is enabled on inbound BPDUs). So is the most secure method to configure BPDU guard AND BPDU filter in global config mode, so that no BPDUs are sent out of portfast ports and if we receive a BPDU in then it's gonna put the port in err-disabled?
Just checking I'm not missing anything here where it would be possible for a loop or security measure to be breached? If that theory is correct, I'm gonna enable it on all our access switches at work (We just use bpdu guard atm, so actually are still sending bpdu's outbound).
