Brocade Multi-Service IronWare Switching Configuration Guide (Supporting R05.6.00) - Manual (Page 352)

322 Multi-Service IronWare Switching Configuration Guide
53-1003036-02
IEEE 802.1D Spanning Tree Protocol (STP)
12
NOTE
The hello-time value parameter applies only when the device or VLAN is the root bridge for its
spanning tree.
Changing STP port parameters
To change the path and priority costs for a port, enter commands such as the following.
Brocade(config)# vlan 10
Brocade(config-vlan-10)# spanning-tree ethernet 1/5 path-cost 15 priority 64
Syntax: [no] spanning-tree ethernet slot/portnum path-cost value | priority value | disable |
enable
The ethernet slot/portnum parameter specifies the interface.
For descriptions of path cost and priority, their default and possible values, refer to Table 51 . If you
enter a priority value that is not divisible by four, the software rounds it to the nearest value.
The disable | enable parameter disables or re-enables STP on the port. The STP state change
affects only this VLAN. The port’s STP state in other VLANs is not changed.
Root Guard
In this release, a new security feature has been added that allows a port to run STP but not allow
the connected device to become the Root. The Root Guard feature provides a way to enforce the
root bridge placement in the network and allows STP to interoperate with user network bridges
while still maintaining the bridged network topology that the administrator requires. Errors are
triggered if any change from the root bridge placement is detected.
NOTE
The feature is also available for MSTP and RSTP.
When Root Guard is enabled on a port, it keeps the port in designated FORWARDING state. If the
port receives a superior BPDU, which is a Root Guard violation, it sets the port into BLOCKING state
and triggers a Syslog message and an SNMP trap. No further traffic will be forwarded on this port.
This allows the bridge to prevent traffic from being forwarded on ports connected to rogue or
misconfigured STP or RSTP bridges.
Root Guard should be configured on all ports where the root bridge should not appear. In this way,
the core bridged network can be cut off from the user network by establishing a protective
perimeter around it.
Once the port stops receiving superior BPDUs, Root Guard will automatically set the port back to a
FORWARDING state after the timeout period has expired.
NOTE
Root Guard may prevent network connectivity if improperly configured. It needs to be configured on
the perimeter of the network rather than the core. Also, Root Guard should be configured only on the
primary port of a LAG. If a port configured with Root Guard is made a secondary port, the LAG
deployment will be vetoed.