Dell MX9116n EMC SmartFabric OS10 User Guide - Page 419

1. Enable spanning-tree BPDU filter in INTERFACE mode. spanning-tree bpdufilter enable 2. Enable STP BPDU guard in INTERFACE mode. spanning-tree bpduguard enable BPDU guard violation causes the system to perform the following actions: • Shuts down the port channel interface and all member ports are disabled in the hardware. • Adds the physical port to a port-channel already in the Error_Disable state; also, the new member port is disabled in the hardware. • Removes a physical port from a port-channel in Error Disable state. After removing the physical port from the port channel, the system clears the Error_Disabled state on the physical port and it is enabled in the hardware. To clear the Error Disabled state: • Use the shutdown command on the interface. • Use the spanning-tree bpduguard disable command to disable the BPDU guard on the interface. • Use the spanning-tree disable command to disable STP on the interface. 3. Set the guard types to avoid loops in INTERFACE mode. spanning-tree guard {loop | root | none} • loop - Set the guard type to loop. • root - Set the guard type to root. • none - Set the guard type to none. Port enabled with loop guard conditions • Loop guard is supported on any STP-enabled port or port-channel interface in RPVST+ mode. • You cannot enable root guard and loop guard at the same time on an STP port. The loop guard configuration overwrites an existing root guard configuration and vice versa. • Enabling BPDU guard and loop guard at the same time on a port results in a port that remains blocking and prevents traffic from flowing through it. For example, when you configure both Portfast BPDU guard and loop guard: • If a BPDU is received from a remote device, BPDU guard places the port in the Err-Disabled Blocking state and no traffic forwards on the port. • If no BPDU is received from a remote device which was sending BPDUs, loop guard places the port in the Loop-Inconsistent Blocking state and no traffic forwards on the port. • When used in a PVST+ network, STP loop guard performs per-port or per port-channel at a VLAN level. If no BPDUs are received on a port-channel interface, the port or port-channel transitions to a Loop-Inconsistent or Blocking state only for this VLAN. BPDU filter OS10(conf-if-eth1/1/4)# spanning-tree bpdufilter enable OS10(conf-if-eth1/1/4)# do show spanning-tree interface ethernet 1/1/4 ethernet1/1/4 of vlan1 is designated Blocking Edge port:no (default) port guard :none (default) Link type is point-to-point (auto) Boundary: NO bpdu filter : Enable bpdu guard : bpduguard shutdown-on- violation :disable RootGuard: enable LoopGuard disable Bpdus (MRecords) sent 134, received 138 Interface Designated Name PortID Prio Cost Sts Cost Bridge ID PortID ethernet1/1/4 128.272 128 500 BLK 500 32769 90b1.1cf4.a911 128.272 BPDU guard OS10(config)# interface ethernet 1/1/4 OS10(conf-if-eth1/1/4)# spanning-tree bpduguard enable OS10(conf-if-eth1/1/4)# do show spanning-tree interface ethernet 1/1/4 ethernet1/1/4 of vlan1 is designated Blocking Edge port:no (default) port guard :none (default) Link type is point-to-point (auto) Boundary: NO bpdu filter : Enable bpdu guard : bpduguard shutdown-onviolation :enable RootGuard: enable LoopGuard disable Bpdus (MRecords) sent 134, received 138 Layer 2 419