Configuring Bpdu Filtering; Configuring Bpdu Guard - Raisecom ISCOM2600G-HI (A) Series Configuration Manual

Raisecom
ISCOM2600G-HI (A) Series Configuration Guide
Step
1
2
3

2.6.8 Configuring BPDU filtering

After being enabled with BPDU filtering, the edge interface does not send BPDUs nor process
received BPDUs.
Configure BPDU filtering for the ISCOM2600G-HI series switch as below.
Step
1
2
3

2.6.9 Configuring BPDU Guard

Generally, on a switch, interfaces are directly connected with terminals (such as a PC) or file
servers are configured to an edge interfaces. Therefore, these interfaces can be transferred
quickly.
In normal status, these edge interfaces will not receive BPDUs. If somebody attacks the
switch by forging the BPDU, the device will configure these edge interfaces to non-edge
interfaces when these edge interfaces receive the forged BPDU and re-perform spanning tree
calculation. This may cause network vibration.
BPDU Guard provided by MSTP can prevent this attack. After BPDU Guard is enabled, edge
interfaces can avoid attack from forged BPDUs.
After BPDU Guard is enabled, the device will shut down the edge interfaces if they receive
BPDUs and notify the NView NNM system of the case. The blocked edge interface is restored
only by the administrator through the CLI.
Step
1
2
Command
Raisecom#config
Raisecom(config)#interface
interface-type interface-number
Raisecom(config-
gigaethernet1/1/port)#spanning-tree
link-type { auto | point-to-point |
shared }
Command
Raisecom#config
Raisecom(config)#interface
interface-type interface-number
Raisecom(config-
gigaethernet1/1/port)#spanning-
tree edged-port bpdu-filter enable
interface-type interface-number
Command
Raisecom#config
Raisecom(config)#spanning-tree
bpduguard enable
Raisecom Proprietary and Confidential
Copyright © Raisecom Technology Co., Ltd.
Description
Enter global configuration mode.
Enter physical layer interface
configuration mode.
Configure the link type for
interface.
Description
Enter global configuration mode.
Enter physical layer interface
configuration mode.
Enable BPDU filtering on the
edge interface.
Description
Enter global configuration mode.
Enable BPDU Guard.
2 Ethernet
93