TL-SL3428_V3_User_Guide - TP-Link

A CIST and its secondary root bridges are usually located in the high-bandwidth core region.Wrong configuration or malicious attacks may result in configuration BPDU packets with higherpriorities being received by the legal root bridge, which causes the current legal root bridge to loseits position and network topology jitter to occur. In this case, flows that should travel alonghigh-speed links may lead to low-speed links, and network congestion may occur.To avoid this, MSTP provides root protect function. Ports with this function enabled can only be setas designated ports in all spanning tree instances. When a port of this type receives BDPUpackets with higher priority, it transits its state to blocking state and stops forwarding packets (as ifit is disconnected from the link). The port resumes the normal state if it does not receive anyconfiguration BPDU packets with higher priorities for a period of two times of forward delay.‣ TC ProtectA switch removes MAC address entries upon receiving TC-BPDU packets. If a user maliciouslysends a large amount of TC-BPDU packets to a switch in a short period, the switch will be busywith removing MAC address entries, which may decrease the performance and stability of thenetwork.To prevent the switch from frequently removing MAC address entries, you can enable the TCprotect function on the switch. With TC protect function enabled, if the account number of thereceived TC-BPDUs exceeds the maximum number you set in the TC threshold field, the switchwill not performs the removing operation in the TC protect cycle. Such a mechanism prevents theswitch from frequently removing MAC address entries.‣ BPDU ProtectPorts of the switch directly connected to PCs or servers are configured as edge ports to rapidlytransit their states. When these ports receive BPDUs, the system automatically configures theseports as non-edge ports and regenerates spanning trees, which may cause network topology jitter.Normally these ports do not receive BPDUs, but if a user maliciously attack the switch by sendingBPDUs, network topology jitter occurs.To prevent this attack, MSTP provides BPDU protect function. With this function enabled on theswitch, the switch shuts down the edge ports that receive BPDUs and reports these cases to theadministrator. If a port is shut down, only the administrator can restore it.‣ BPDU FilterBPDU filter function is to prevent BPDUs flood in the STP network. If a switch receives maliciousBPDUs, it forwards these BPDUs to the other switched in the network, which may result inspanning trees being continuously regenerated. In this case, the switch occupying too much CPUor the protocol status of BPDUs is wrong.With BPDU filter function enabled, a port does not receive or forward BPDUs, but it sends out itsown BPDUs. Such a mechanism prevents the switch from being attacked by BPDUs so as toguarantee generation the spanning trees correct.Choose the menu Spanning Tree→STP Security→Port Protect to load the following page.84