BPDUGuard
The BPDU-guard feature allows network designers to enforce the STP domain borders and keep the active topology predictable. Devices behind ports with BPDU-guard enabled are unable to influence the STP topology. Such devices include hosts running Yersinia, for example. At the reception of a BPDU, BPDU-guard disables the port. BPDU-guard transitions the port into the errdisable state, and a message is generated. See the second entry in the section, "References," for more details.
Example 3-4 shows root guard blocking a port receiving a superior BPDU. Example 3-4 Root Guard in Action
6K-2-S2# configure terminal
Enter configuration commands, one per line. End with CNTL/Z. 6K-2-S2(config)# interface fastethernet 8/1 6K-2-S2(config-if)# spanning-tree rootguard
*Dec 30 18:25:16: %SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Rootguard enabled on port FastEthernet8/1 VLAN 123.
Dec 30 18:33:41.677: %SPANTREE-SP-2-ROOTGUARD_BLOCK: Root guard blocking port Fa stEthernet8/1 on VLAN0123. 6K-2-S2#sh spanning-tree vlan 123 ac
Example 3-4 Root Guard in Action (Continued)
VLAN0123
Spanning tree enabled protocol rstp Root ID Priority 32891
Address 0050.3e05.9c00 This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32891 (priority 32768 sys-id-ext 123)
Address 0050.3e05.9c00
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300
Interface
Role Sts Cost
Prio.Nbr Type
Fa8/1 Fa8/45 Gi9/14 Gi9/15
Desg BKN*19 Desg FWD 19 Desg FWD 4 Desg FWD 4
240.897 P2p *ROOT_Inc 128.941 P2p
128.1038 P2p
128.1039 Edge P2p
! "Desg" means designated port role; BKN means status blocking; ! FWD means forwarding. Notice the "ROOT Inc" status for port Fa8/1.
If the attack stops, or if it was fortuitous, the port swiftly moves back to forwarding. This can take as little as three times the hello interval (6 sec, by default) if only a single superior BPDU was received.
Unless explicitly configured to bridge—which is a rare occurrence—end stations, such as PCs running any sort of operating system (OS), IP phones, printers, and so on, should never generate BPDUs, let alone superior BPDUs. Therefore, BPDU-guard is, and should be, usually preferred to root guard on access ports. BPDU-guard is much less forgiving than root guard: It instructs STP to error-disable a port in case any BPDU arrives on it. After a port is placed in the error-disabled state, there are two ways to recover from the action: either through a manual intervention (do/do not shut down the port) or through an automatic recovery timer whose minimum value is 30 sec. Example 3-5 shows how to configure this using Cisco IOS on a Catalyst 6500. (As usual, consult your switch's documentation for the exact syntax and availability of the feature.)
6K-2-S2#conf t
Enter configuration commands, one per line. End with CNTL/Z. 6K-2-S2(config)#int f8/1
6K-2-S2(config-if)#spanning-tree bpduguard enable
6K-2-S2(config-if)#exit
6K-2-S2(config)#exit
6K-2-S2(config)#errdisable recovery cause bpduguard 6K-2-S2(config)#errdisable recovery ?
Example 3-5 How to Configure BPDU-Guard continues
Example 3-5 How to Configure BPDU-Guard (Continued)
cause Enable error disable recovery for application interval Error disable recovery timer value
6K-2-S2(config)#errdisable recovery inter 6K-2-S2(config)#errdisable recovery interval ?
<30-86400> timer-interval(sec)
6K-2-S2(config)#errdisable recovery interval 30
Immediately after a BPDU is received on the port, these messages are printed:
Dec 30 18:23:58.685: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet8/1, changed state to down Dec 30 18:23:58.683: %SPANTREE-SP-2-BLOCK_BPDUGUARD: Received BPDU on port
FastEthernet8/1 with BPDU Guard enabled. Disabling port. Dec 30 18:23:58.683: %PM-SP-4-ERR_DISABLE: bpduguard error detected on Fa8/1, putting Fa8/1 in err-disable state
If this BPDU was the result of an accident, the port is restored 30 sec later:
Dec 30 18:24:28.535: %PM-SP-4-ERR_RECOVER: Attempting to recover from bpduguard err-disable state on Fa8/1
By using the following command, it is possible to globally enable BPDU-guard on all portfast-enabled ports:
6K-2-S2(config)#spanning-tree portfast bpduguard ?
default Enable bdpu guard by default on all portfast ports
Portfast
Portfast is a port-based setting that instructs the port on which it is enabled to bypass the listening and learning phases of STP. The effect is that the port directly moves to forwarding, accepting, and sending traffic. The setting is typically applied to ports where end devices are attached, such as laptops, printers, servers, and so on.
Unlike root guard, BPDU-guard is not limited only to root takeover attempts. Any incoming BPDU disables the port—period. On many Cisco IOS versions, BPDU-guard no longer requires a port to be portfast-enabled.
Continue reading here: BPDU Filtering
Was this article helpful?