17.2.5 Understanding TC Guard
The Tc-Protection function can ensure to reduce the dynamic MAC address and remove the
ARP when the network produces a large number of tc packets. However, it will still produce
much deletion operation when it suffers from the TC packets attack. Furthermore, the TC
packet is spreaded and will have an effect on the whole network. We allow users to prohibit
the spreading of the TC packet on the ports with the globally mode by using the TC Guard
function. When one port receives the TC message, if the TC guard is configured globally or
on a port, this port will shield the TC packet received or produced by this port, to prevent the
TC packet spreading into other ports. In this way, it can effectively control the possible TC
attack existed in the network, to ensure the stability of the network, especially on the L3
device. This function can avoid the interruption of the core routing caused by the vibration of
the access layer device effectively.
17.2.6 Understanding BPDU Source MAC
Check
The BPDU source MAC is checked in order to prevent malicious attack on the switch by
sending BPDU packets manually to cause failure MSTP. When the switch of point-to-point
connection to the remote is determined for a port, the BPDU source MAC check can be
configured, so that only BPDU frames from the remote switch are received, while all other
BPDU frames are discarded, preventing malicious attacks. You can configure corresponding
MAC addresses for BPDU source MAC check for a specific port in the interface mode. Only
one filtered MAC is allowed for one port. BPDU source MAC check can be disabled by using
no bpdu src-mac-check, when the port does not receive any BPDU frame.
17.2.7 Understanding Illegal Length
Filtering for BPDU
When the Ethernet length field of BPDU exceeds 1500, this BPDU frame is discarded in
order to avoid receiving illegal BPDU packets.
17.2.8 Understanding Automatic
Identification of Edge Ports
If the specified port doesn‘t receive the BPDU sent by the downstream within a certain
period of time (3 s), it will be considered that this port is connected with one network device,
and this port will be set as the edge port to enter the Forwarding status directly. The port
automatically identified as the edge port will be identified as the non edge port for it receives
the BPDU automatically.
You can cancel the automatic identification function of the edge port by the spanning-tree
autoedge disabled command.
This function is enabled by default.
To Next Page
Loading...
Need help?
General