Enabling Root Guard - HP 3100 Series Configuration Manual

Enabling BPDU guard on an interface or port group
You can enable BPDU guard on specific edge ports when it is globally disabled.
To enable BPDU guard on an interface or port group:
Step
Enter system view.
1.
Enter interface view
2.
or port group view.
Enable BPDU guard.
3.

Enabling root guard

The root bridge and secondary root bridge of a spanning tree should be located in the same MST
region. Especially for the CIST, the root bridge and secondary root bridge are put in a high-bandwidth
core region during network design. However, due to possible configuration errors or malicious
attacks in the network, the legal root bridge might receive a configuration BPDU with a higher priority.
Another device will supersede the current legal root bridge, causing an undesired change of the
network topology. The traffic that should go over high-speed links is switched to low-speed links,
resulting in network congestion.
To prevent this situation, MSTP provides the root guard function. If the root guard function is enabled
on a port of a root bridge, this port plays the role of designated port on all MSTIs. After this port
receives a configuration BPDU with a higher priority from an MSTI, it immediately sets that port to the
listening state in the MSTI, without forwarding the packet. This is equivalent to disconnecting the link
connected with this port in the MSTI. If the port receives no BPDUs with a higher priority within twice
the forwarding delay, it reverts to its original state.
Configure root guard on a designated port.
To enable root guard:
Step
Enter system view.
1.
Enter interface view or port
2.
group view.
Enable the root guard
3.
function for the ports.
Command
system-view
•
Enter Layer 2 Ethernet interface
view or Layer 2 aggregate interface
view:
interface interface-type
interface-number
•
Enter port group view:
port-group manual
port-group-name
stp port bpdu-protection enable
Command
system-view
•
Enter Layer 2 Ethernet interface
view or Layer 2 aggregate
interface view:
interface interface-type
interface-number
•
Enter port group view:
port-group manual
port-group-name
stp root-protection
86
Remarks
N/A
N/A
By default, BPDU guard is
enabled on all edge ports if it is
globally enabled. BPDU guard is
disabled on all edge ports if it is
disabled globally.
Remarks
N/A
Use either command.
Disabled by default.