No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Configuration Guide - Ethernet Switching

CloudEngine 8800, 7800, 6800, and 5800 V200R003C00

This document describes the configuration of Ethernet services, including configuring MAC address table, link aggregation, VLANs, MUX VLAN, Voice VLAN, VLAN mapping, QinQ, GVRP, VCMP, STP/RSTP/MSTP, VBST, SEP, RRPP, ERPS, LBDT, and Layer 2 protocol transparent transmission.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Configuring BPDU Protection on a Switching Device

Configuring BPDU Protection on a Switching Device

Context

Edge ports are directly connected to user terminals and will not receive BPDUs in normal cases. If an edge port receives pseudo BPDUs from a malicious attacker, the switching device sets the edge port as a non-edge port and triggers spanning tree recalculation, which results in network flapping. BPDU protection can be configured to protect switching devices against such attacks.

NOTE:

Perform the following procedure on all switching devices that have edge ports.

BPDU protection is only valid for the edge port manually configured by the stp edged-port or stp edged-port default command, and is invalid for the edge port configured by the automatic detection function.

Procedure

  1. Run system-view

    The system view is displayed.

  2. Run stp bpdu-protection

    BPDU protection is enabled on the switching device.

    By default, BPDU protection is disabled on a switching device.

  3. Run commit

    The configuration is committed.

Follow-up Procedure

After BPDU protection is configured, the edge port that receives BPDUs will enter the Error-Down state and keeps its attributes. The device records the status of an interface as Error-Down when it detects that a fault occurs. The interface in Error-Down state cannot receive or send packets and the interface indicator is off. You can run the display error-down recovery command to check information about all interfaces in Error-Down state on the device.

When the interface is in Error-Down state, check the cause. You can use the following modes to restore the interface status:
  • Manual (after the interface enters the Error-Down state)

    When there are few interfaces in Error-Down state, you can run the shutdown and undo shutdown commands in the interface view or run the restart command to restore the interface.

  • Auto (before the interface enters the Error-Down state)

    If there are many interfaces in Error-Down state, the manual mode brings in heavy workload and the configuration of some interfaces may be ignored. To prevent this problem, run the error-down auto-recovery cause bpdu-protection interval interval-value command in the system view to enable an interface in error-down state to go Up and set a recovery delay. You can run the display error-down recovery command to view automatic recovery information about the interface.

    NOTE:

    This mode is invalid for the interface that has entered the Error-Down state, and is only valid for the interface that enters the Error-Down state after the error-down auto-recovery cause bpdu-protection interval interval-value command is used.

Translation
Download
Updated: 2019-05-08

Document ID: EDOC1100004351

Views: 126306

Downloads: 295

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next