Operation Manual – MSTP
H3C S3610&S5510 Series Ethernet Switches
Chapter 1 MSTP Configuration
1-48
Follow these steps to enable BPDU guard:
To do...
Use the command...
Remarks
Enter system view
system-view
—
Enable the BPDU guard
function for the device
stp bpdu-protection
Required
Disabled by default
1.9.3 Enabling Root Guard
Note:
z
The support for this feature depends on the specific device model.
z
We recommend that you enable root guard if your device supports this function.
The root bridge and secondary root bridge of a panning tree should be located in the
same MST region. Especially for the CIST, the root bridge and secondary root bridge
are generally put in a high-bandwidth core region during network design. However, due
to possible configuration errors or malicious attacks in the network, the legal root bridge
may receive a configuration BPDU with a higher priority. In this case, the current, legal
root bridge will be superseded by another device, causing undesired change of the
network topology. As a result of this kind of illegal topology change, the traffic that
should go over high-speed links is drawn to low-speed links, resulting in network
congestion.
To prevent this situation from happening, MSTP provides the root guard function to
protect the root bridge. If the root guard function is enabled on a port, this port will keep
playing the role of designated port on all MST instances. Once this port receives a
configuration BPDU with a higher priority from an MST instance, it immediately sets
that instance port to the listening state, without forwarding the packet (this is equivalent
to disconnecting the link connected with this port). If the port receives no BPDUs with a
higher priority within twice the forwarding delay, the port will revert to its original state.
Follow these steps to enable root guard:
