Enabling Root Guard; Enabling Loop Guard - HPE FlexFabric 5940 Series Configuration Manual

Step
Enter system view.
1.
Enter Layer 2 Ethernet
2.
interface or Layer 2
aggregate interface view.
Configure BPDU guard.
3.

Enabling root guard

The root bridge and secondary root bridge of a spanning tree should be located in the same MST
region. Especially for the CIST, the root bridge and secondary root bridge are put in a high-bandwidth
core region during network design. However, due to possible configuration errors or malicious
attacks in the network, the legal root bridge might receive a configuration BPDU with a higher priority.
Another device supersedes the current legal root bridge, causing an undesired change of the
network topology. The traffic that should go over high-speed links is switched to low-speed links,
resulting in network congestion.
To prevent this situation, MSTP provides the root guard feature. If root guard is enabled on a port of
a root bridge, this port plays the role of designated port on all MSTIs. After this port receives a
configuration BPDU with a higher priority from an MSTI, it performs the following operations:
•
Immediately sets that port to the listening state in the MSTI.
•
Does not forward the received configuration BPDU.
This is equivalent to disconnecting the link connected to this port in the MSTI. If the port receives no
BPDUs with a higher priority within twice the forwarding delay, it reverts to its original state.
On a port, the loop guard feature and the root guard feature are mutually exclusive.
Configure root guard on a designated port.
To enable root guard:
Step
Enter system view.
1.
Enter Layer 2 Ethernet interface or Layer
2.
2 aggregate interface view.
Enable the root guard feature.
3.

Enabling loop guard

By continuing to receive BPDUs from the upstream device, a device can maintain the state of the
root port and blocked ports. However, link congestion or unidirectional link failures might cause these
ports to fail to receive BPDUs from the upstream devices. In this situation, the device reselects the
following port roles:
•
Those ports in forwarding state that failed to receive upstream BPDUs become designated
ports.
•
The blocked ports transit to the forwarding state.
Command
system-view
interface interface-type
interface-number
stp port bpdu-protection
{ enable | disable }
Command
system-view
interface interface-type
interface-number
stp root-protection
127
Remarks
N/A
The specified interface must
connect to a user terminal rather
than other device or shared LAN
segment.
By default, BPDU guard is not
configured on a per-edge port
basis. The status of BPDU guard on
an interface is the same as the
global BPDU status.
Remarks
N/A
N/A
By default, root guard is
disabled.