95Step Command Remarksfeature. stp bpdu-protection• Configure BPDU guard on aper-interface basis:a. interface interface-typeinterface-numberb. stp portbpdu-protection{ disable | enable }By default, BPDU guard is globallydisabled and not configured on aper-interface basis.Enabling root guardThe root bridge and secondary root bridge of a spanning tree should be located in the same MSTregion. Especially for the CIST, the root bridge and secondary root bridge are put in a high-bandwidthcore region during network design. However, due to possible configuration errors or maliciousattacks in the network, the legal root bridge might receive a configuration BPDU with a higher priority.Another device supersedes the current legal root bridge, causing an undesired change of thenetwork topology. The traffic that should go over high-speed links is switched to low-speed links,resulting in network congestion.To prevent this situation, MSTP provides the root guard feature. If root guard is enabled on a port ofa root bridge, this port plays the role of designated port on all MSTIs. After this port receives aconfiguration BPDU with a higher priority from an MSTI, it performs the following operations:• Immediately sets that port to the listening state in the MSTI.• Does not forward the received configuration BPDU.This is equivalent to disconnecting the link connected to this port in the MSTI. If the port receives noBPDUs with a higher priority within twice the forwarding delay, it reverts to its original state.On a port, the loop guard feature and the root guard feature are mutually exclusive.Configure root guard on a designated port.To enable root guard:Step Command Remarks1. Enter system view. system-view N/A2. Enter Layer 2 Ethernet oraggregate interface view. interface interface-type interface-number N/A3. Enable the root guardfeature. stp root-protection By default, root guard isdisabled.Enabling loop guardBy continuing to receive BPDUs from the upstream device, a device can maintain the state of theroot port and blocked ports. However, link congestion or unidirectional link failures might cause theseports to fail to receive BPDUs from the upstream devices. In this situation, the device reselects thefollowing port roles:• Those ports in forwarding state that failed to receive upstream BPDUs become designatedports.• The blocked ports transit to the forwarding state.As a result, loops occur in the switched network. The loop guard feature can suppress theoccurrence of such loops.
