H3C S7500 Series Ethernet Switches Command Manual

Command Manual – MSTP
H3C S7500 Series Ethernet Switches Chapter 1
MSTP Configuration Commands
1-41
You can avoid this by utilizing the root guard function. Ports with this function enabled
can only be kept as designated ports in all MSTIs. When a port of this type receives
configuration BPDUs with higher priorities, it changes to discarding state (rather than
becomes a non-designated port) and stops forwarding packets (as if it is disconnected
from the link). It resumes the normal state if it does not receive any configuration
BPDUs with higher priorities for a specified period.
Related commands: stp interface root-protection.
Examples
# Enable the root guard function on Ethernet 2/0/1.
<H3C> system-view
System View: return to User View with Ctrl+Z.
[H3C] interface Ethernet2/0/1
[H3C-Ethernet2/0/1] stp root-protection
1.1.39 stp tc-protection
Syntax
stp tc-protection enable
stp tc-protection disable
View
System view
Parameters
None
Description
Use the stp tc-protection enable command to enable the TC-BPDU guard function.
Use the stp tc-protection disable command to disable the TC-BPDU guard function.
By default, the TC-BPDU guard function is enabled.
A switch removes MAC address entries and ARP entries upon receiving TC-BPDUs. If
a malicious user sends a large amount of TC-BPDUs to a switch in a short period, the
switch may busy itself in removing MAC address entries and ARP entries, which may
decreases the performance and stability of the switch.
With the TC-BPDU guard function enabled, a switch performs only one removing
operation in a specified period (10 seconds by default) after it receives a TC-BPDU.
The switch also checks to see if other TC-BPDUs arrive in this period and performs
another removing operation in the next period if a TC-BPDU is received. Such a
mechanism prevents a switch from being busying itself in performing removing
operations.