Configuring and managing BPDU protection

BPDU protection is a security feature designed to protect the active STP topology by preventing spoofed BPDU packets from entering the STP domain. In a typical implementation, BPDU protection would be applied to edge ports connected to end user devices that do not run STP. If STP BPDU packets are received on a protected port, the feature will disable that port and alert the network manager via an SNMP trap as shown in the following diagram.

Figure 16: BPDU protection enabled at the network edge

The following commands allow you to configure BPDU protection on VLANs for which the port is a member.

Syntax: 


no spanning-tree port-list bpdu-protection

Enables/disables the BPDU protection feature on a port.

Default: Disabled.

Syntax: 


no spanning-tree port-list bpdu-protection-timeout timeout

Configures the duration of time when protected ports receiving unauthorized BPDUs will remain disabled. The default value of 0 (zero) sets an infinite timeout (that is, ports that are disabled by bpdu-protection are not, by default, re-enabled automatically).

Default: 0

Range: 0 - 65535 seconds

Syntax: 


no spanning-tree trap errant-bpdu

Enables/disables the sending of errant BPDU traps.

CAUTION:

This command should only be used to guard edge ports that are not expected to participate in STP operations. Once BPDU protection is enabled, it will disable the port as soon as any BPDU packet is received on that interface.