Dell BigIron RX Series, Configuration Manual

Page: 406 / 1458

330 BigIron RX Series Configuration Guide
53-1002253-01
IEEE 802.1D Spanning Tree Protocol (STP)
12
NOTE
The hello-time <value> parameter applies only when the device or VLAN is the root bridge for its
spanning tree.
Changing STP port parameters
To change the path and priority costs for a port, enter commands such as the following.
BigIron RX(config)# vlan 10
BigIron RX(config-vlan-10)# spanning-tree ethernet 1/5 path-cost 15 priority 64
Syntax: spanning-tree ethernet <slot>/<portnum> path-cost <value> | priority <value> | disable
| enable
The ethernet <slot>/<portnum> parameter specifies the interface.
For descriptions of path cost and priority, their default and possible values, refer to Table 73 on
page 329. If you enter a priority value that is not divisible by four, the software rounds it to the
nearest value.
The disable | enable parameter disables or re-enables STP on the port. The STP state change
affects only this VLAN. The port’s STP state in other VLANs is not changed.
STP root guard
In release 02.3.00, a new security feature that allows a port to run STP but not allow the connected
device to become the Root has been added. The STP Root Guard feature provides a way to enforce
the root bridge placement in the network and trigger errors if any changes from the root bridge
placement are detected. This feature allows STP to interoperate with user network bridges while
still maintaining the bridged network topology that the administrator requires.
When Root Guard is enabled on a port, it keeps the port in designated FORWARDING state. If the
port receives a superior STP BPDU, it sets the port into BLOCKING and triggers a log message and
an SNMP trap. No further traffic will be forwarded on this port. This allows the bridge to prevent
traffic from being forwarded on ports connected to rogue or misconfigured STP bridges.
Root Guard should be configured on all ports where the root bridge should not appear. In this way,
the core bridged network can be cut off from the user network by establishing a protective
perimeter around it.
Once the port stops receiving superior BPDUs, root protect will automatically set the port back to a
FORWARDING state after the timeout period has expired.
NOTE
Root Guard may prevent network connectivity if improperly configured. It needs to be configured on
the perimeter of the network rather than the core.
Enabling STP root guard
A STP Root Guard is configured on a per interfaces basis. To enable a Root Guard, enter a
command such as the following.
BigIron RX (config)#interface ethernet 5/5
BigIron RX(config-if-e10000-5/5)spanning-tree root-protect