Enabling Root Guard; Enabling Loop Guard - H3C S6850 Series Configuration Manual

Configure BPDU guard.
3.
stp port bpdu-protection { enable | disable }
By default, the enabling status of BPDU guard on an interface is the same as that of global
BPDU guard.

Enabling root guard

About root guard
Configure root guard on a designated port.
The root bridge and secondary root bridge of a spanning tree should be located in the same MST
region. Especially for the CIST, the root bridge and secondary root bridge are put in a high-bandwidth
core region during network design. However, due to possible configuration errors or malicious
attacks in the network, the legal root bridge might receive a configuration BPDU with a higher priority.
Another device supersedes the current legal root bridge, causing an undesired change of the
network topology. The traffic that should go over high-speed links is switched to low-speed links,
resulting in network congestion.
To prevent this situation, MSTP provides the root guard feature. If root guard is enabled on a port of
a root bridge, this port plays the role of designated port on all MSTIs. After this port receives a
configuration BPDU with a higher priority from an MSTI, it performs the following operations:
•
Immediately sets that port to the listening state in the MSTI.
•
Does not forward the received configuration BPDU.
This is equivalent to disconnecting the link connected to this port in the MSTI. If the port receives no
BPDUs with a higher priority within twice the forwarding delay, it reverts to its original state.
Restrictions and guidelines
On a port, the loop guard feature and the root guard feature are mutually exclusive.
Procedure
Enter system view.
1.
system-view
Enter interface view.
2.
interface interface-type interface-number
Enable the root guard feature.
3.
stp root-protection
By default, root guard is disabled.

Enabling loop guard

About loop guard
Configure loop guard on the root port and alternate ports of a device.
By continuing to receive BPDUs from the upstream device, a device can maintain the state of the
root port and blocked ports. However, link congestion or unidirectional link failures might cause these
ports to fail to receive BPDUs from the upstream devices. In this situation, the device reselects the
following port roles:
•
Those ports in forwarding state that failed to receive upstream BPDUs become designated
ports.
•
The blocked ports transit to the forwarding state.
49