Operation Manual – MSTP
H3C S5100-SI/EI Series Ethernet Switches
Chapter 1 MSTP Configuration
1-43
Normally, no configuration BPDU will reach edge ports. But malicious users can attack
a network by sending configuration BPDUs deliberately to edge ports to cause network
jitter. You can prevent this type of attacks by utilizing the BPDU guard function. With this
function enabled on a switch, the switch shuts down the edge ports that receive
configuration BPDUs and then reports these cases to the administrator. Ports shut
down in this way can only be restored by the administrator.
II. Root guard
A root bridge and its secondary root bridges must reside in the same region. The root
bridge of the CIST and its secondary root bridges are usually located in the
high-bandwidth core region. Configuration errors or attacks may result in configuration
BPDUs with their priorities higher than that of a root bridge, which causes a new root
bridge to be elected and network topology jitter to occur. In this case, flows that should
travel along high-speed links may be led to low-speed links, and network congestion
may occur.
You can avoid this problem by utilizing the root guard function. Ports with this function
enabled can only be kept as designated ports in all MSTIs. When a port of this type
receives configuration BPDUs with higher priorities, it turns to the discarding state
(rather than become a non-designated port) and stops forwarding packets (as if it is
disconnected from the link). It resumes the normal state if it does not receive any
configuration BPDUs with higher priorities for a specified period.
III. Loop guard
A switch maintains the states of the root port and other blocked ports by receiving and
processing BPDUs from the upstream switch. These BPDUs may get lost because of
network congestions or unidirectional link failures. If a switch does not receive BPDUs
from the upstream switch for certain period, the switch selects a new root port; the
original root port becomes a designated port; and the blocked ports turns to the
forwarding state. This may cause loops in the network.
The loop guard function suppresses loops. With this function enabled, if link
congestions or unidirectional link failures occur, both the root port and the blocked ports
become designated ports and turn to the discarding state. In this case, they stop
forwarding packets, and thereby loops can be prevented.
Caution:
With the loop guard function enabled, the root guard function and the edge port
configuration are mutually exclusive.
