Dell N1100-ON, Reference Manual

Page: 748 / 2332

Layer 2 Switching Commands
748
Command Mode
Global Configuration mode
User Guidelines
The administrator should ensure that interfaces on which BDPU guard is
enabled are configured as edge ports. To configure an interface as an edge
port, use the spanning-tree portfast command.
An edge port is generally connected to a user terminal (such as a desktop
computer) or file server directly and is configured as an edge port to
implement a fast transition to the forwarding state. When the port receives a
BPDU packet, the system sets it to non-edge port and recalculates the
spanning tree topology, which may cause network topology flapping. In
normal cases, edge ports do not receive any BPDU packets. However, an
attacker may forge BPDU packets to maliciously disrupt the switch and cause
network flapping.
Dell spanning-tree provides a BPDU guard function against such attacks. If
an interface enabled for BPDU guard receives a BPDU packet, the interface is
diagnostically disabled and a message is written to the log. The port may be
re-enabled using the no shutdown command after disconnecting the
offending device from the interface.
Example
The following example enables BPDU protection.
console(config)#spanning-tree bpdu-protection
spanning-tree cost
Use the spanning-tree cost command in Interface Configuration mode to
configure the externally advertised spanning-tree path cost for a port. To
return to the default port path cost, use the no form of this command.
The path cost is used in the selection of an interface for the forwarding or
blocking states. Use the no form of the command to automatically select the
path cost based upon the speed of the interface.
Syntax
spanning-tree [vlan vlan-list] cost cost