3Com 8807 Configuration Manual page 147

Configuring MSTP 147
clearing dynamic ARP entries in port view, the function takes effect only on the
specified port.
Configuring the Switch An MSTP switch provides BPDU protection, Root protection functions, loop
Protection Function protection and TC-protection.
BPDU protection
For an access device, the access port is generally directly connected to the user
terminal (for example, PC) or a file server, and the access port is set to an edge
port to implement fast transition. When such a port receives BPDU packet, the
system will automatically set it as a non-edge port and recalculate the spanning
tree, which causes the network topology flapping. In normal cases, these ports will
not receive STP BPDU. If someone forges BPDU to attack the switch, the network
will flap. BPDU protection function is used against such network attacks.
Root protection
The primary and secondary root bridges of the spanning tree, especially those of
ICST, shall be located in the same region. It is because the primary and secondary
roots of CIST are generally placed in the core region with a high bandwidth in
network design. In case of configuration error or malicious attack, the legal
primary root may receive the BPDU with a higher priority and then loose its place,
which causes network topology change errors. Due to the illegal change, the
traffic supposed to travel over the high-speed link may be pulled to the low-speed
link and congestion will occur on the network. Root protection function is used
against such problems.
Loop protection
The root port and other blocked ports maintain their states according to the
BPDUs send by uplink switch. Once the link is blocked or has trouble, then the
ports cannot receive BPDUs and the switch will select root port again. In this case,
the downstream switch selects the port role again. The downstream bridge port
that cannot receive BGPUs becomes specific port and the blocked port is
transferred to the forwarding state. As a result, a link loop is generated. The loop
protection function can prohibit such loop.
n
For the loop protection-enabled port, when the loop protection takes effect
because the port cannot receive the BPDU sent by the upstream switches, if the
port participates in STP calculation, all the instances of the port will be always set
to be in discarding state regardless of the port role.
TC-protection
As a general rule, the switch deletes the corresponding entries in the MAC address
table and ARP table upon receiving TC-BPDU packets. Under malicious attacks of
TC-BPDU packets, the switch shall receive a great number of TC-BPDU packets in a
very short period. Too frequent delete operations shall consume huge switch
resources and bring great risk to network stability.
When the protection from TC-BPDU packet attack is enabled, the switch just
perform one delete operation in a specified period (generally, 15 seconds) after
receiving TC-BPDU packets, as well as monitoring whether it receives TC-BPDU
packets during this period. Even if it detects a TC-BPDU packet is received in a
period shorter than the specified interval, the switch shall not run the delete