268 CHAPTER 30: MSTP C ONFIGURATION system-view[SW7750] interface ethernet1/0/1[SW7750-Ethernet1/0/1] stp loop-protectionTC-BPDU AttackPreventionConfigurationConfiguration prerequisitesMSTP is enabled on the current switch.Configuration procedureConfiguration example# Enable the TC-BPDU attack prevention function system-view[SW7750] stp tc-protection enable# Configure the switch to remove MAC addresses for up to 5 times within 10seconds. system-view[SW7750] stp tc-protection threshold 5Digest SnoopingConfigurationIntroduction According to IEEE 802.1s, two interconnected MSTP switches can interwork witheach other through MSTIs in an MST region only when the two switches have thesame MST region-related configuration. Interconnected MSTP switches determinewhether or not they are in the same MST region by checking the configuration IDsof the BPDUs between them. (A configuration ID contains information such asregion ID and configuration digest.)As some partners’ switches adopt proprietary spanning tree protocols, they cannotinterwork with other switches in an MST region even if they are configured withthe same MST region-related settings as other switches in the MST region.This problem can be overcome by implementing the digest snooping feature. If aport on a Switch 7750 is connected to a partner’s switch that has the same MSTregion-related configuration as its own but adopts a proprietary spanning treeprotocol, you can enable digest snooping on the port. Then the Switch 7750regards the partner’s switch as in the same region; it records the configurationdigests carried in the BPDUs received from the partner’s switch, and put them inTable 203 Enable the TC-BPDU attack prevention functionOperation Command DescriptionEnter system view system-view -Enable the TC-BPDU attackprevention functionstp tc-protectionenableRequiredThe TC-BPDU attack preventionfunction is enabled by default.Configure the times for theswitch to remove MAC addresstables within 10 secondsstp tc-protectionthreshold numberOptional
