bpdufilter and bpduguard

This might have been asked multiple times. I understand the differences, but
could not really convenience myself is what recommendation should I follow

!
interface GigabitEthernet1/0/38
 switchport access vlan 10
 switchport mode access
 spanning-tree portfast
 spanning-tree bpdufilter enable
 spanning-tree bpduguard enable
!

Or,
!
spanning-tree portfast bpdufilter default
!
interface GigabitEthernet1/0/38
 switchport access vlan 10
 switchport mode access
 spanning-tree portfast
  spanning-tree bpduguard enable
!

The second option looks promising to me as bpduguard will take precedence and
will put the port in err-disable state before BPDUFilter can transition the
port back to normal.

-Yuri

Blogs and organic groups at http://www.ccie.net
Received on Tue Mar 01 2011 - 10:46:13 ART