Operation Manual – MSTP
H3C S3100 Series Ethernet Switches
Chapter 1 MSTP Configuration
1-43
Operation
Command
Description
Enter Ethernet port view
interface
interface-type
interface-number
—
Perform the mCheck operation
stp mcheck
Required
1.5.3 Configuration Example
# Perform the mCheck operation on Ethernet 1/0/1.
1)
Perform this configuration in system view
<Sysname> system-view
[Sysname] stp interface Ethernet1/0/1 mcheck
2)
Perform this configuration in Ethernet port view
<Sysname> system-view
[Sysname] interface Ethernet1/0/1
[Sysname-Ethernet1/0/1] stp mcheck
1.6 Configuring Guard Functions
1.6.1 Introduction
The following guard functions are available on an MSTP-enabled switch: BPDU guard,
root guard, loop guard, TC-BPDU attack guard, and BPDU drop.
I. BPDU guard
Normally, the access ports of the devices operating on the access layer are directly
connected to terminals (such as PCs) or file servers. These ports are usually
configured as edge ports to achieve rapid transition. But they resume non-edge ports
automatically upon receiving configuration BPDUs, which causes spanning tree
recalculation and network topology jitter.
Normally, no configuration BPDU will reach edge ports. But malicious users can attack
a network by sending configuration BPDUs deliberately to edge ports to cause network
jitter. You can prevent this type of attacks by utilizing the BPDU guard function. With this
function enabled on a switch, the switch shuts down the edge ports that receive
configuration BPDUs and then reports these cases to the administrator. Ports shut
down in this way can only be restored by the administrator.
II. Root guard
A root bridge and its secondary root bridges must reside in the same region. The root
bridge of the CIST and its secondary root bridges are usually located in the
high-bandwidth core region. Configuration errors or attacks may result in configuration
BPDUs with their priorities higher than that of a root bridge, which causes a new root
