Configuring Loop Guard; Configuring Tc-Bpdu Attack Guard - 3Com E4500-24 Cli Configuration Manual

Configuring Loop Guard

A switch maintains the states of the root port and other blocked ports by receiving and processing
BPDUs from the upstream switch. These BPDUs may get lost because of network congestions or
unidirectional link failures. If a switch does not receive BPDUs from the upstream switch for certain
period, the switch selects a new root port; the original root port becomes a designated port; and the
blocked ports turns to the forwarding state. This may cause loops in the network.
The loop guard function suppresses loops. With this function enabled, if link congestions or
unidirectional link failures occur, both the root port and the blocked ports become designated ports and
turn to the discarding state. In this case, they stop forwarding packets, and thereby loops can be
prevented.
You are recommended to enable loop guard on the root port and alternate port of a non-root bridge.
Loop guard, root guard, and edge port settings are mutually exclusive. With one of these functions
enabled on a port, any of the other two functions cannot take effect even if you have configured it
on the port.
Configuration Prerequisites
MSTP runs normally on the switch.
Configuration procedure
Follow these steps to configure loop guard:
To do...
Enter system view
Enter Ethernet port view
Enable the loop guard function on
the current port
Configuration example
# Enable the loop guard function on Ethernet 1/0/1.
<Sysname> system-view
[Sysname] interface Ethernet 1/0/1
[Sysname-Ethernet1/0/1] stp loop-protection

Configuring TC-BPDU Attack Guard

Normally, a switch removes its MAC address table and ARP entries upon receiving Topology Change
BPDUs (TC-BPDUs). If a malicious user sends a large amount of TC-BPDUs to a switch in a short
Use the command...
system-view
interface interface-type
interface-number
stp loop-protection
1-37
Remarks
—
—
Required
The loop guard function is
disabled by default.