Operation Manual – MSTP
H3C S9500 Series Routing Switches
Chapter 1 MSTP Configuration
1-47
ports are not supposed to receive configuration BPDUs. However, if someone forges
configuration BPDUs maliciously to attack the devices, network may become instable.
MSTP provides the BPDU guard function to protect the system against such attacks.
With the BPDU guard function enabled on the devices, edge ports receiving
configuration BPDUs are shut down and the NMS is informed. Those ports closed
thereby can be restored only by the network administrators.
z
Root guard
The root bridge and its secondary root bridges of a spanning tree must reside in the
same MST region. Especially for the CIST, the root bridge and its secondary root
bridges are generally put in a high-bandwidth core region during network design.
However, due to possible configuration errors or attacks in the network, the root bridge
may receive a configuration BPDU with a higher priority. In this case, the current, legal
root bridge will be superseded by another device, causing undesired change of the
network topology. As a result of this kind of illegal topology change, the traffics that are
to travel along high-speed links may be led to low-speed links, resulting in network
congestion.
To prevent this situation from happening, MSTP provides the root guard function to
protect the root bridge. Ports with root guard function enabled can only be designated
ports in all MSTIs. Once a port of this type receives a configuration BPDU with a higher
priority from an MSTI, it turns to the listening state in the MSTI and stops forwarding
packets (as if it is disconnected from the link). If the port receives no BPDUs with higher
priorities within twice the forwarding delay, the port reverts to its original state.
z
Loop guard
A device maintains the states of its root port and blocked ports by receiving and
processing BPDUs from the upstream device. However, due to link congestion or
unidirectional link failures, these ports may fail to receive BPDUs from the upstream
device. In this case, the downstream device will reselect the port roles (for example,
ports failing to receive upstream BPDUs become designated ports and the blocked
ports transition to the forwarding state), resulting in loops in the switched network. The
loop guard function can suppress the occurrence of such loops.
Note:
A loop guard–enabled port that fails to receive BPDUs from the upstream device
remains in the discarding state in all the MSTIs in the process of STP computing,
regardless of the role it plays.
z
TC-BPDU attack guard