95
Step Command
Remarks
feature.
stp bpdu-protection
•
Configure BPDU guard on a
per-interface basis:
a. interface
interface-type
interface-number
b. stp
port
bpdu-protection
{
disable
|
enable
}
By default, BPDU guard is globally
disabled and not configured on a
per-interface basis.
Enabling root guard
The root bridge and secondary root bridge of a spanning tree should be located in the same MST
region. Especially for the CIST, the root bridge and secondary root bridge are put in a high-bandwidth
core region during network design. However, due to possible configuration errors or malicious
attacks in the network, the legal root bridge might receive a configuration BPDU with a higher priority.
Another device supersedes the current legal root bridge, causing an undesired change of the
network topology. The traffic that should go over high-speed links is switched to low-speed links,
resulting in network congestion.
To prevent this situation, MSTP provides the root guard feature. If root guard is enabled on a port of
a root bridge, this port plays the role of designated port on all MSTIs. After this port receives a
configuration BPDU with a higher priority from an MSTI, it performs the following operations:
•
Immediately sets that port to the listening state in the MSTI.
•
Does not forward the received configuration BPDU.
This is equivalent to disconnecting the link connected to this port in the MSTI. If the port receives no
BPDUs with a higher priority within twice the forwarding delay, it reverts to its original state.
On a port, the loop guard feature and the root guard feature are mutually exclusive.
Configure root guard on a designated port.
To enable root guard:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter Layer 2 Ethernet or
aggregate interface view.
interface interface-type interface-number
N/A
3.
Enable the root guard
feature.
stp root-protection
By default, root guard is
disabled.
Enabling loop guard
By continuing to receive BPDUs from the upstream device, a device can maintain the state of the
root port and blocked ports. However, link congestion or unidirectional link failures might cause these
ports to fail to receive BPDUs from the upstream devices. In this situation, the device reselects the
following port roles:
•
Those ports in forwarding state that failed to receive upstream BPDUs become designated
ports.
•
The blocked ports transit to the forwarding state.
As a result, loops occur in the switched network. The loop guard feature can suppress the
occurrence of such loops.
Summary of Contents for H3C S7500E-X
Page 70: ...57 ...
