Enabling Tc-Bpdu Guard; Enabling Bpdu Drop - H3C S3600V2 SERIES Layer 2-Lan Switching Configuration Manual

Enabling TC-BPDU guard

When a switch receives topology change (TC) BPDUs (the BPDUs that notify devices of topology
changes), the switch flushes its forwarding address entries. If someone forges TC-BPDUs to attack the
switch, the switch will receive a large number of TC-BPDUs within a short time and be busy with
forwarding address entry flushing. This affects network stability.
With the TC-BPDU guard function, you can set the maximum number of immediate forwarding address
entry flushes that the device can perform every a specified period of time (10 seconds). For TC-BPDUs
received in excess of the limit, the device performs a forwarding address entry flush when the time period
expires. This prevents frequent flushing of forwarding address entries.
To enable TC-BPDU guard:
Step
1. Enter system view.
2. Enable the TC-BPDU guard function.
3. Configure the maximum number of
forwarding address entry flushes that the
device can perform every 10 seconds.
NOTE:
H3C does not recommend you disable this feature.

Enabling BPDU drop

In a spanning tree network, after receiving BPDUs, the device performs STP calculation according to the
received BPDUs and forwards received BPDUs to other devices in the network. This allows malicious
attackers to attack the network by forging BPDUs. By continuously sending forged BPDUs, they can make
all the devices in the network perform STP calculations all the time. As a result, problems such as CPU
overload and BPDU protocol status errors occur.
To avoid this problem, you can enable BPDU drop on ports. A BPDU drop-enabled port does not receive
any BPDUs and is invulnerable to forged BPDU attacks.
To enable BPDU drop on an Ethernet interface:
Step
1. Enter system view.
2. Enter Layer 2 Ethernet
interface view.
3. Enable BPDU drop on the
current interface.
NOTE:
Because a port with BPDU drop enabled also drops the received 802.1X packets, do not enable BPDU
drop and 802.1X on a port at the same time. For more information about 802.1X, see
Configuration Guide
Command
system-view
interface interface-type
interface-number
bpdu-drop any
.
Command
system-view
stp tc-protection enable
stp tc-protection threshold
number
101
Remarks
N/A
Optional.
Enabled by default.
Optional.
6 by default.
Remarks
N/A
N/A
Disabled by default.
Security