H3C Technologies H3C S3100 Series Switches - Manual (Page 209)

Operation Manual – MSTP
H3C S3100-52P Ethernet Switch
Chapter 1 MSTP Configuration
1-34
1.5 Configuring Protection Function
1.5.1 Introduction
The following protection functions are available on an MSTP-enabled switch: BPDU
protection, root protection, loop prevention, and TC-BPDU attack prevention.
I. BPDU protection
Normally, the access ports of the devices operating on the access layer are directly
connected to terminals (such as PCs) or file servers. These ports are usually
configured as edge ports to achieve rapid transition. But they resume non-edge ports
automatically upon receiving configuration BPDUs, which causes spanning tree
recalculation and network topology jitter.
Normally, no configuration BPDU will reach edge ports. But malicious users can attack
a network by sending configuration BPDUs deliberately to edge ports to cause network
jitter. You can prevent this type of attacks by utilizing the BPDU protection function.
With this function enabled on a switch, the switch shuts down the edge ports that
receive configuration BPDUs and then reports these cases to the administrator. If a port
is shut down, only the administrator can restore it.
II. Root protection
A root bridge and its secondary root bridges must reside in the same region. The root
bridge of the CIST and its secondary root bridges are usually located in the
high-bandwidth core region. Configuration errors or attacks may result in configuration
BPDUs with their priorities higher than that of a root bridge, which causes a new root
bridge to be elected and network topology jitter to occur. In this case, flows that should
travel along high-speed links may be led to low-speed links, and network congestion
may occur.
You can avoid this problem by utilizing the root protection function. Ports with this
function enabled can only be kept as designated ports in all spanning tree instances.
When a port of this type receives configuration BPDUs with higher priorities, it turns to
the discarding state (rather than become a non-designated port) and stops forwarding
packets (as if it is disconnected from the link). It resumes the normal state if it does not
receive any configuration BPDUs with higher priorities for a specified period.
III. Loop prevention
A switch maintains the states of the root port and other blocked ports by receiving and
processing BPDUs from the upstream switch. These BPDUs may get lost because of
network congestions or unidirectional link failures. If a switch does not receive BPDUs
from the upstream switch for certain period, the switch selects a new root port; the
original root port becomes a designated port; and the blocked ports turns to the
forwarding state. This may cause loops in the network.