121
Enabling TC-BPDU guard
When a device receives topology change (TC) BPDUs (the BPDUs that notify devices of topology
changes), it flushes its forwarding address entries. If someone forges TC-BPDUs to attack the device, the
device will receive a large number of TC-BPDUs within a short time and be busy with forwarding address
entry flushing. This affects network stability.
TC-BPDU guard allows you to set the maximum number of immediate forwarding address entry flushes
performed within 10 seconds after the device receives the first TC-BPDU. For TC-BPDUs received in excess
of the limit, the device performs a forwarding address entry flush when the time period expires. This
prevents frequent flushing of forwarding address entries. H3C recommends that you enable TC-BPDU
guard.
To enable TC-BPDU guard:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable the TC-BPDU guard function.
stp tc-protection
By default, TC-BPDU guard is
enabled.
H3C recommends not
disabling this feature.
3.
(Optional.) Configure the maximum
number of forwarding address entry
flushes that the device can perform every
10 seconds.
stp tc-protection threshold
number
The default setting is 6.
Enabling BPDU drop
In a spanning tree network, every BPDU arriving at the device triggers an STP calculation process and is
then forwarded to other devices in the network. Malicious attackers might use the vulnerability to attack
the network by forging BPDUs. By continuously sending forged BPDUs, they can make all devices in the
network keeps performing STP calculations. As a result, problems such as CPU overload and BPDU
protocol status errors occur.
To avoid this problem, you can enable BPDU drop on ports. A BPDU drop-enabled port does not receive
any BPDUs and is invulnerable to forged BPDU attacks.
To enable BPDU drop on an Ethernet interface:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter Layer 2 Ethernet
interface view.
interface
interface-type
interface-number
N/A
3.
Enable BPDU drop on the
current interface.
bpdu-drop any
By default, BPDU drop is disabled.