Configuring BPDU Protection on the Switch

Context

Edge ports are directly connected to user terminals and, in most cases, will not receive BPDUs. However, attackers may send pseudo BPDUs to attack the switch with edge ports. In this case, if the edge ports receive the BPDUs, they are then configured as non-edge ports and spanning tree recalculation is triggered. Network flapping then occurs. Such attacks can be mitigated using BPDU protection on switches with edge ports. After BPDU protection is enabled on the switch, the switch shuts down an edge port if the edge port receives a BPDU.

Procedure

Run system-view
The system view is displayed.
Run stp bpdu-protection
BPDU protection is enabled on the switch.

By default, BPDU protection is disabled on the switch.

Follow-up Procedure

To configure a shutdown edge port to go Up automatically, run the error-down auto-recovery cause bpdu-protection interval interval-value command in the system view to configure the automatic recovery function and set the recovery delay. After the delay expires, the port automatically goes Up. Note the following when setting interval interval-value:

A smaller value indicates a shorter delay for the port to go Up automatically and a higher frequency at which the port alternates between Up and Down states.
A larger value indicates a longer delay for the port to go Up automatically and longer traffic interruption.