cancel
Showing results for 
Search instead for 
Did you mean: 

Securing Networks with STP Protect and BPDU Guard

Vásquez_Fer
Moderator
Moderator

STP Protect is designed to enhance network stability by causing a port to drop STP BPDUs originating from the device connected at the other end of the link. The primary function of this STP protection is to prevent end stations from either initiating or engaging in changes to the STP topology. This feature is crucial for maintaining a consistent and stable network structure, especially in environments where end stations should not influence the network's layout or data flow paths.

STP Protection Enhancement https://docs.commscope.com/bundle/fastiron-09010-l2guide/page/GUID-A4F0188F-A7FE-49D3-A79D-5E48AC481...

Vsquez_Fer_0-1706362611909.png

 

The BPDU Guard feature is a  security measure in Layer 2 Spanning Tree Protocol (STP) networks, designed to defend against BPDU-related threats and prevent accidental misconfigurations. When enabled on an access port, BPDU Guard ensures that if a BPDU is received, the port will enter an error-disabled state. Recovery from this state requires a manual shutdown and restart of the interface or configuring an auto recovery.

Re-enabling ports disabled by BPDU guard :  https://docs.commscope.com/bundle/fastiron-08090-l2guide/page/GUID-072E446B-D157-4815-8C02-E5EA4D2D5...

Enabling an error-disabled port automatically : https://docs.commscope.com/bundle/fastiron-08090-l2guide/page/GUID-5B6686B1-CAAB-44FA-B2EB-2854B0805...

 

Vsquez_Fer_1-1706362611924.png

Vsquez_Fer_2-1706362611938.png

Ruckus's implementation of 802.1W allows for the configuration of Edge ports in the network topology. Edge ports, typically connecting to workstations or computers, do not process incoming BPDUs and are assumed to have Designated port roles.

 These ports are not considered in STP calculations, meaning that port flapping on Edge ports does not trigger topology change events. This makes Edge ports a critical component in maintaining the stability and security of the network.

Edge ports and edge port roles  https://docs.commscope.com/bundle/fastiron-08090-l2guide/page/GUID-27AA7467-42F3-4D32-81EB-975051BA3...

Configuring 802.1W Rapid Spanning Tree Protocol  https://docs.commscope.com/bundle/fastiron-09010-l2guide/page/GUID-A7C9E7F9-8349-4B09-82D5-A4AA81723...

As Summary STP Protect concentrates on ensuring the stability of the STP network. In contrast, BPDU Guard serves as a security feature that safeguards the network against detrimental BPDU packets. This protection helps prevent complications such as STP loops and unauthorized alterations in the network topology.

For additional information, please refer to the Layer 2 guide available on the support portal.

https://support.ruckuswireless.com/documents/4465-fastiron-10-0-10-ga-layer-2-switching-configuratio...

0 REPLIES 0