Configuring BPDU Protection on a Switching Device
Context
Edge ports are directly connected to user terminals and, in most cases, will not receive BPDUs. However, attackers may send pseudo BPDUs to attack the switching device with edge ports. In this case, if the edge ports receive the BPDUs, they are then configured as non-edge ports and spanning tree recalculation is triggered. Network flapping then occurs. Such attacks can be mitigated using BPDU protection on switching devices with edge ports.
BPDU protection is only valid for the edge port manually configured by the stp edged-port or stp edged-port default command, and is invalid for the edge port configured by the automatic detection function.
Procedure
- Run system-view
The system view is displayed.
- (Optional) Run stp process process-id
The MSTP process view is displayed.
Skip this step if you perform configurations in the MSTP process 0.
- Run stp bpdu-protection
BPDU protection is enabled on the switching device.
By default, BPDU protection is disabled on a switching device.
- Run commit
The configuration is committed.
Follow-up Procedure
After BPDU protection is configured, the edge port that receives BPDUs will enter the Error-Down state and keeps its attributes. The device records the status of an interface as Error-Down when it detects that a fault occurs. The interface in Error-Down state cannot receive or send packets and the interface indicator is off. You can run the display error-down recovery command to check information about all interfaces in Error-Down state on the device.
Manual (after interfaces enter the Error-Down state)
When there are few interfaces in Error-Down state, run the shutdown and undo shutdown commands in the interface view or run the restart command to restore the interface.
Auto (before interfaces enter the Error-Down state)
If there are many interfaces in Error-Down state, the manual mode brings in heavy workload and the configuration of some interfaces may be ignored. To prevent this problem, run the error-down auto-recovery cause bpdu-protection interval interval-value command in the system view to enable an interface in Error-Down state to go Up and set a recovery delay. You can run the display error-down recovery command to view automatic recovery information about the interface.
This mode is invalid for the interface that has entered the Error-Down state, and is valid only for the interface that enters the Error-Down state after the error-down auto-recovery cause bpdu-protection interval interval-value command is run.