A rogue consumer switch gets plugged into a nurse-station wall jack, and its bridging behavior starts destabilizing the ward's access-layer spanning tree topology. Which AOS-CX access-port feature is designed to prevent exactly this kind of problem?
Select an answer to reveal the explanation.
Short Explanation
An access port plugged into a nurse's workstation should never see bridge traffic — no legitimate PC sends BPDUs. BPDU guard treats any BPDU shown up on an edge port as a red flag and shuts the port down before a rogue switch can mess with the spanning tree.
Full Explanation
Edge ports on the access layer are configured for devices that should never behave like a switch, so BPDU guard is built to detect any spanning-tree BPDU arriving on such a port and immediately disable it, isolating the rogue device before it can influence root-bridge elections or introduce a loop. Native VLAN tagging addresses which VLAN untagged frames belong to on a trunk and has nothing to do with detecting bridging devices on an access port — it solves a completely different classification problem. Increasing an LACP timeout is unrelated to spanning tree behavior entirely; LACP governs link aggregation negotiation, not loop prevention, and touching it does nothing to stop a rogue switch's BPDUs. Disabling spanning tree on the whole access switch removes the very mechanism that detects loops network-wide, trading one localized nurse-station problem for the much larger risk of an undetected broadcast storm anywhere else a loop later forms. Caveat: BPDU guard should only be applied to genuine edge ports connecting end devices, never to legitimate uplinks, or a real trunk link will be shut down as a false positive. Operational check: after a BPDU-guard event, check the interface's error-disabled reason and physically inspect the jack before re-enabling the port.