Configuring BPDU Protection on a Switching Device
Context
Edge ports are directly connected to user terminals and will not receive BPDUs in normal cases. If an edge port receives pseudo BPDUs from a malicious attacker, the switching device sets the edge port as a non-edge port and triggers spanning tree recalculation, which results in network flapping. BPDU protection can be configured to protect switching devices against such attacks.
Perform the following procedure on all switching devices that have edge ports.
BPDU protection is only valid for the edge port manually configured by the stp edged-port or stp edged-port default command, and is invalid for the edge port configured by the automatic detection function.
Procedure
- Run system-view
The system view is displayed.
- Run stp bpdu-protection
BPDU protection is enabled on the switching device.
By default, BPDU protection is disabled on a switching device.
- Run commit
The configuration is committed.
Follow-up Procedure
After BPDU protection is configured, the edge port that receives BPDUs will enter the Error-Down state and keeps its attributes. The device records the status of an interface as Error-Down when it detects that a fault occurs. The interface in Error-Down state cannot receive or send packets and the interface indicator is off. You can run the display error-down recovery command to check information about all interfaces in Error-Down state on the device.
Manual (after the interface enters the Error-Down state)
When there are few interfaces in Error-Down state, you can run the shutdown and undo shutdown commands in the interface view or run the restart command to restore the interface.
Auto (before the interface enters the Error-Down state)
If there are many interfaces in Error-Down state, the manual mode brings in heavy workload and the configuration of some interfaces may be ignored. To prevent this problem, run the error-down auto-recovery cause bpdu-protection interval interval-value command in the system view to enable an interface in error-down state to go Up and set a recovery delay. You can run the display error-down recovery command to view automatic recovery information about the interface.
This mode is invalid for the interface that has entered the Error-Down state, and is only valid for the interface that enters the Error-Down state after the error-down auto-recovery cause bpdu-protection interval interval-value command is used.