Configuration Prerequisites; Configuring Bpdu Guard - H3C S3100 8C SI Operation Manual

Operation Manual – MSTP
H3C S3100 Series Ethernet Switches
You can use the stp tc-protection threshold command to set the maximum times for a
switch to remove the MAC address table and ARP entries in a specific period. When
the number of the TC-BPDUs received within a period is less than the maximum times,
the switch performs a removing operation upon receiving a TC-BPDU. After the number
of the TC-BPDUs received reaches the maximum times, the switch stops performing
the removing operation. For example, if you set the maximum times for a switch to
remove the MAC address table and ARP entries to 100 and the switch receives 200
TC-BPDUs in the period, the switch removes the MAC address table and ARP entries
for only 100 times within the period.
V. BPDU dropping
In a STP-enabled network, some users may send BPDU packets to the switch
continuously in order to destroy the network. When a switch receives the BPDU
packets, it will forward them to other switches. As a result, STP calculation is performed
repeatedly, which may occupy too much CPU of the switches or cause errors in the
protocol state of the BPDU packets.
In order to avoid this problem, you can enable BPDU dropping on Ethernet ports. Once
the function is enabled on a port, the port will not receive or forward any BPDU packets.
In this way, the switch is protected against the BPDU packet attacks so that the STP
calculation is assured to be right.
Note:
Only the S3100-EI series among S3100 series switches support the BPDU dropping
feature.

1.6.2 Configuration Prerequisites

MSTP runs normally on the switch.

1.6.3 Configuring BPDU Guard

I. Configuration procedure
Table 1-36 Configure BPDU guard
Operation
Enter system view
Command
system-view
1-45
Chapter 1 MSTP Configuration
Description
—