Aut inveniam viam aut faciam

STP Security Features Notes

STP Security Features

BPDU Guard

 – Checks for any incoming BPDUs

 – Will block any port that receives a BPDU

     -> The port is err-disabled

 – Global configuration

     -> Only affects ports configured for portfast

SW1(config)# spanning-tree portfast bpduguard default

 – Interface configuration

     -> Portfast not required

     -> “no” command used to disable BPDU Guard on the interface if it is configured globally

SW1(config)# int fa0/1

 spanning-tree bpduguard enable

BPDU Filter

  – Global configuration

     -> Stops sending BPDUs out all interfaces configured for portfast

     -> If BPDU is received

          -> Disables portfast

          -> Starts listening / learning procedure

SW1(config)# spanning-tree portfast bpdufilter default

 – Interface configuration

     -> Stops sending BPDUs on the interface

     -> Ignores received BPDUs

SW1(config)# int fa0/1

 spanning-tree bpdufilter enable

If BPDU Guard and BPDU Filter are configured on the same interface

 – Stops sending BPDUs out the interface

 – The interface is err-disabled if a BPDU is received

Root Guard

 – Interface configuration

     -> Exams incoming BPDUs

     -> If a superior BPDU is received, the port is err-disabled

     -> Root inconsistant mode

     -> Recommended for edge switches

          -> Can be configured on the root switch

SW1(config)# int fa0/1

 spanning-tree guard root

Loop Guard

 – On a non-designated port (blocking)

     -> If BPDUs are no longer received, the port is err-disabled

Unidirectional Link Detection (UDLD)

 – Can be configured on any link between two ports

 – Has hello mechanism to check tx & rx

     -> Sent every 15 seconds

     -> If 3 consecutive hellos are missed, an action is taken

          -> udld mode normal

               -> Syslog message

               -> SNMP trap sent (if configured)

          -> udld mode aggressive

               -> Starts sending hellos every second for 8 seconds

               -> If no hellos are received, the port is err-disabled

 – Global configuration

SW1(config)# udld mode { aggressive | normal }

 – Interface configuration

SW1(config)#  int fa0/1

 udld mode { aggressive | normal }

Comments are closed.

This entry was posted on Friday, August 20th, 2021 at 3:08 am and is filed under CCIE. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.