ā11-04-2022 03:06 AM
Hello Everyone,
I read lots of stuff to refresh my knowledge on STP protection mechanism, and I still need your advice on the following:
There is a customer network connected to ours using a trunk port. What is the best way to protect my network against loops and unwanted BPDUs from customer switches - I dont know if they run STP on their network
I assume the following configuration, please review and express your opinion
interface FastEthernet1/0/6
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,15,55,74,164,202,204,234,252,420,706,836
switchport mode trunk
no keepalive
storm-control broadcast level 30.00
spanning-tree bpdufilter enable
spanning-tree guard root
Not sure about BPDU filter, I know it is not supposed to be on a trunk port, but I dont wish to receive BPDUs from the customer switches. Also, not sure if BPDU Filter will overtake Root Guard and effectively disable it
Thank you
ā11-04-2022 03:21 AM - edited ā11-04-2022 03:23 AM
spanning-tree bpdufilter enable <<- make port not send BPDU, this can cause loop if you connect SW to this port,
BPDUfilter is same as disable STP in port
check link below
https://medium.com/ken-m-lai/bpdu-filter-vs-bpdu-guard-a112f967798b
ā11-04-2022 03:46 AM
I am aware of that, but what if that customer is using different mode of STP and I dont with to receive BPDUs from it? Is it still dangerous?
ā11-04-2022 03:25 AM
You need ask couple of question, what is other side equiment, is the cisco or any other vendor before connecting.
if this is 3rd party i would not suggest to allow VLAN1 in the trunk for many many reasons.
make sure all the VLAN you allowing, and you will be STP Root for that VLAN by setting the priority. ( if you enabling the root gaurd look below)
regarding :
spanning-tree bpdufilter enable
some use case and explaned here :
spanning-tree guard root
The configuration of root guard is on a per-port basis. Root guard does not allow the port to become an STP root port, so the port is always STP-designated. If a better BPDU arrives on this port, root guard does not take the BPDU into account and elect a new STP root. Instead, root guard puts the port into the root-inconsistent STP state. You must enable root guard on all ports where the root bridge must not appear. In a way, you can configure a perimeter around the part of the network where the STP root is able to be located.
ā11-04-2022 03:52 AM
Different customers use different switches, but just 2 vendors - HP and Cisco. I agree regarding VLAN 1, I will remove it from the trunk
When it comes to Root Guard, its role is quite obvious, so I will use it on the perimeter of my network to protect our Root
BPDU Filter is still not clear enough for me. I understand how it works, however still can not figure out if it dangerous to use it towards customer network if I do not wish to receive BPDU from them and if it is enabled alongside with Root Guard it would just surpass it
ā11-04-2022 05:02 AM
Hello,
First here is the difference:
BPDU Guard
BPDU Guard is designed to protect your switching network. Remember that a Port-fast port is designed to be connected to a device where BPDUās arenāt expected. This could be a end user device, server or access-point. When an unexpected BPDU is detected (an end-user wants to plug in a switch in his cubicle) the port will shutdown and enter a err-disable state.
BPDU Filter
BPDU filter is a feature used to filter sending or receiving BPDUs on a switchport. It is extremely useful on those ports which are configured as portfast ports as there is no need to send or receive any BPDU messages on of these ports. BPDU filter can be configured globally or under the interface level.
Secondly, you need to have a conversation with your customer about what devices they use and connect to you. You cant effectively run a network with half the information. BPDUs are what help create the spanning tree structure and carry the VLAN information. It allows paths and puts ports in certain states to configure the spanning tree topology. Without it, you WILL create a loop. Spanning tree works automatically and all versions are pretty much compatible with eachother.
Find out what the customer is using and do some more research about how their equipment uses STP and implement changes needed.
Hope that helps
-David
ā11-04-2022 11:53 PM
Hello David,
I talked to the customers - one of them is not running STP at all, another is running pvst with their own root
What would be the best configuration for the uplinks in this case?
ā11-08-2022 04:51 AM
If one customer is not running STP then BPDU filter wont really do anything, as its designed to filter BPDUs, which are a direct result of running STP. If they aren't running STP you wont receive BPDUs.
Secondly with the other customer running PVST you need to coordinate weather they will retain the root bridge or you will take over. You cannot filter BPDUs on that link or you will create weird traffic flow and possibly loop some things since you will be running different Spanning trees. By that I mean actual path trees the spanning tree algorithm makes not versions of STP.
-David
ā11-07-2022 07:43 AM
Hi
In my opinion, for this situation, with different customers, you have no other choice than using bpdu filter. Of course, you can not have redundant links, you have to use single port connection to each customer. If you want to have more than one port, it must be an ether-channel, so it looks like one port.
You may have in mind that if you move your customer connections to L3, you get rid of the spanning-tree problem.
/Mikael
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide