High Secure Mode; Spanning Tree Bpdu Filtering - Avaya 8800 Planning And Engineering

Network security
You can also enable the spoof-detect feature on a port.
For more information about the spoof-detect feature, see Avaya Ethernet Routing Switch
8800/8600 Configuration — VLANs and Spanning Tree, NN46205-517.
You can also use the R series module predefined Access Control Template (ACT) for ARP
spoof detection. For more information about this ACT, see Avaya Ethernet Routing Switch
8800/8600 Configuration — QoS and IP Filtering for R and RS Modules, NN46205-507.

High Secure mode

To ensure that the Avaya Ethernet Routing Switch 8800/8600 does not route packets with an
illegal source address of 255.255.255.255 (in accordance with RFC 1812 Section 4.2.2.11 and
RFC 971 Section 3.2), you can enable High Secure mode.
By default, this feature is disabled. When you enable this flag, the feature is applied to all ports
belonging to the same OctaPid (group of 8 10/100 Mbit/s ports [8648 modules].
For more information about hsecure, see Avaya Ethernet Routing Switch 8800/8600 Security,
NN46205-601.

Spanning Tree BPDU filtering

To prevent unknown devices from influencing the Spanning Tree topology, the Avaya Ethernet
Routing Switch 8800/8600 supports Bridge Protocol Data Unit (BPDU) Filtering for Avaya
Spanning Tree Groups (STPG), Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning
Tree Protocol (MSTP).
With BPDU Filtering, the network administrator can achieve the following:
• Block an unwanted root selection process when an edge device (for example, a laptop
running Linux and enabled with STP) is added to the network. This prevents unknown
devices from influencing an existing spanning tree topology.
• Block the flooding of BPDUs from an unknown device.
When a port has BPDU Filtering enabled and the port receives an STP BPDU, the following
actions take place:
• The port is immediately put in the operational disabled state.
• A trap is generated and the following log message is written to the log: Ethernet <x>
is shut down by BPDU Filter
• The port timer starts.
• The port stays in the operational disabled state until the port timer expires.
If you disable the timer or reset the switch before the timer expires, the port remains in the
disabled state. If you disable BPDU Filtering while the timer is running, the timer stops and the
254 Planning and Engineering — Network Design November 2010