Default Protocol Storm Protection Configuration; How To Configure Protocol Storm Protection; Enabling Protocol Storm Protection - Cisco Catalyst 2960-XR Security Configuration Manual

Default Protocol Storm Protection Configuration

• Spanning Tree Protocol (STP) reconverges because the STP bridge protocol data unit (BPDU) cannot
• CLI is slow or unresponsive.
Using protocol storm protection, you can control the rate at which control packets are sent to the switch by
specifying the upper threshold for the packet flow rate. The supported protocols are ARP, ARP snooping,
Dynamic Host Configuration Protocol (DHCP) v4, DHCP snooping, Internet Group Management Protocol
(IGMP), and IGMP snooping.
When the packet rate exceeds the defined threshold, the switch drops all traffic arriving on the specified virtual
port for 30 seconds. The packet rate is measured again, and protocol storm protection is again applied if
necessary.
For further protection, you can manually error disable the virtual port, blocking all incoming traffic on the
virtual port. You can manually enable the virtual port or set a time interval for automatic re-enabling of the
virtual port.
Excess packets are dropped on no more than two virtual ports.
Note
Virtual port error disabling is not supported for EtherChannel and Flexlink interfaces
Default Protocol Storm Protection Configuration
Protocol storm protection is disabled by default. When it is enabled, auto-recovery of the virtual port is disabled
by default.

How to Configure Protocol Storm Protection

Enabling Protocol Storm Protection

SUMMARY STEPS
1. configure terminal
2. psp {arp | dhcp | igmp} pps value
3. errdisable detect cause psp
4. errdisable recovery interval time
5. end
6. show psp config {arp | dhcp | igmp}
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
348
be sent or received.
Configuring Port-Based Traffic Control
OL-29434-01