beautypg.com

Configuration procedure, Configuring protection functions, Enabling bpdu guard – H3C Technologies H3C S12500-X Series Switches User Manual

Page 104: Enabling root guard

background image

93

Configuration procedure

# Enable No Agreement Check on Ten-GigabitEthernet 1/0/1 of Device A.

system-view

[DeviceA] interface ten-gigabitethernet 1/0/1

[DeviceA-Ten-GigabitEthernet1/0/1] stp no-agreement-check

Configuring protection functions

A spanning tree device supports the following protection functions:

BPDU guard

Root guard

Loop guard

Port role restriction

TC-BPDU transmission restriction

TC-BPDU guard

Enabling BPDU guard

For access layer devices, the access ports can directly connect to the user terminals (such as PCs) or file

servers. The access ports are configured as edge ports to allow rapid transition. When these ports
receive configuration BPDUs, the system automatically sets the ports as non-edge ports and starts a new

spanning tree calculation process. This causes a change of network topology. Under normal conditions,

these ports should not receive configuration BPDUs. However, if someone forges configuration BPDUs

maliciously to attack the devices, the network will become unstable.
The spanning tree protocol provides the BPDU guard function to protect the system against such attacks.

With the BPDU guard function enabled on the devices, when edge ports receive configuration BPDUs,

the system closes these ports and notifies the NMS that these ports have been closed by the spanning tree

protocol. The device reactivates the closed ports after a detection interval. For more information about

this detection interval, see Fundamentals Configuration Guide.
BPDU guard does not take effect on loopback-testing-enabled ports. For more information about

loopback testing, see "Configuring Ethernet interfaces."
Configure BPDU guard on a device with edge ports configured.
To enable BPDU guard:

Step Command

Remarks

1.

Enter system view.

system-view

N/A

2.

Enable the BPDU guard
function for the device.

stp bpdu-protection

By default, BPDU guard is
disabled.

Enabling root guard

The root bridge and secondary root bridge of a spanning tree should be located in the same MST region.

Especially for the CIST, the root bridge and secondary root bridge are put in a high-bandwidth core

This manual is related to the following products: