DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
Chapter 11 BPDU Attack Protection Command
List
config bpdu_protection ports [<portlist> | all ] {state [enable | disable] | mode [ drop | block | shutdown} (1)
config bpdu_protection recovery_timer [<sec 60-1000000> | infinite]
config bpdu_protection [trap | log] [none | attack_detected | attack_cleared | both] enable bpdu_protection disable bpdu_protection
show bpdu_protection {ports {<portlist>}}
11-1 config bpdu_protection ports
Description
This command is used to configure the BPDP protection function for the ports on the Switch. In generally, there are two states in BPDU protection function. One is normal state, and another is under attack state. The under attack state have three modes: drop, block, and shutdown. A BPDU protection enabled port will enter under attack state when it receives one STP BPDU packet. And it will take action based on the configuration. Thus, BPDU protection can only be enabled on STP-disabled port.
BPDU protection has high priority than FBPDU setting configured by configure STP command in determination of
BPDU handling. That is, when FBPDU is configured to forward STP BPDU but BPDU protection is enabled, then the port will not forward STP BPDU.
Format config bpdu_protection ports [<portlist> | all] {state [enable | disable] | mode [ drop | block | shutdown]}(1)
Parameters
<portlist> - Enter a range of ports to be configured (port number).
all - Specify that all the port will be configured.
state - Specify the BPDU protection state. The default state is disable.
enable - Specify to enable BPDU protection.
disable - Specify to disable BPDU protection.
mode - Specify the BPDU protection mode. The default mode is shutdown.
drop - Drops all received BPDU packets when the port enters under_attack state.
block - Drops all packets including BPDU and normal packets when the port enters under_attack state.
shutdown - Shuts down the port when the port enters under_attack state.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To set the port state enable and drop mode:
DGS-3000-26TC:admin#config bpdu_protection ports 1 state enable mode drop
Commands: config bpdu_protection ports 1 state enable mode drop
Success.
DGS-3000-26TC:admin#
120
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
11-2 config bpdu_protection recovery_timer
Description
This command is used to configure BPDU protection recovery timer. When a port enters the ‘under attack’ state, it can be disabled or blocked based on the configuration. The state can be recovered manually or by the auto recovery mechanism. To manually recover the port, the user needs to disable and re-enable the port.
Format config bpdu_protection recovery_timer [<sec 60-1000000> | infinite]
Parameters
<sec 60 –1000000> - Enter the timer (in seconds) used by the Auto-Recovery mechanism to recover the port.
The valid range is 60 to 1000000.
infinite - The port will not be auto recovered.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To configure the bpdu_protection recovery_timer to 120 seconds for the entire switch:
DGS-3000-26TC:admin#config bpdu_protection recovery_timer 120
Commands: config bpdu_protection recovery_timer 120
Success.
DGS-3000-26TC:admin#
11-3 config bpdu_protection
Description
This command is used to configure the BPDU protection trap state or state for the Switch.
Format config bpdu_protection [trap | log] [none | attack_detected | attack_cleared | both]
Parameters
trap - Specify the trap state.
log - Specify the log state.
none - Neither attack_detected nor attack_cleared is trapped or logged.
attack_detected - Events will be logged or trapped when the BPDU attacks is detected.
attack_cleared - Events will be logged or trapped when the BPDU attacks is cleared.
both - The events of attack_detected and attack_cleared shall be trapped or logged.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To config the bpdu_protection trap state as both for the entire switch:
121
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
DGS-3000-26TC:admin#config bpdu_protection trap both
Commands: config bpdu_protection trap both
Success.
DGS-3000-26TC:admin#
11-4 enable bpdu_protection
Description
This command is used to enable BPDU protection function globally for the Switch.
Format enable bpdu_protection
Parameters
None.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
Example
To enable bpdu_protection function globally for the entire switch:
DGS-3000-26TC:admin#enable bpdu_protection
Commands: enable bpdu_protection
Success.
DGS-3000-26TC:admin#
11-5 disable bpdu_protection
Description
This command is used to disable BPDU protection function globally for the Switch.
Format disable bpdu_protection
Parameters
None.
Restrictions
Only Administrators, Operators and Power-Users can issue this command.
122
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
Example
To disable bpdu_protection function globally for the entire switch:
DGS-3000-26TC:admin#disable bpdu_protection
Commands: disable bpdu_protection
Success.
DGS-3000-26TC:admin#
11-6 show bpdu_protection
Description
This command is used to display BPDU protection global configuration or per port configuration and current status.
Format show bpdu_protection {ports {<portlist>}}
Parameters
ports - (Optional) Specify a range of ports to be configured.
<portlist> - Enter the portlist here.
Restrictions
None.
Example
To show the bpdu_protection for the entire switch:
DGS-3000-26TC:admin#show bpdu_protection
Commands: show bpdu_protection
BPDU Protection Global Settings
---------------------------------------
BPDU Protection status : Enabled
BPDU Protection Recovery Time : 60 seconds
BPDU Protection Trap State : None
BPDU Protection Log State : None
DGS-3000-26TC:admin#
To show the bpdu_protection status ports 1-12:
123
DGS-3000 Series Layer 2 Managed Gigabit Ethernet Switch CLI Reference Guide
DGS-3000-26TC:admin#show bpdu_protection ports 1-12
Commands: show bpdu_protection ports 1-12
Port State Mode Status
------ ------------ ----------- ----------
1 Enabled shutdown Normal
2 Enabled shutdown Normal
3 Enabled shutdown Normal
4 Enabled shutdown Normal
5 Enabled shutdown Under Attack
6 Enabled shutdown Normal
7 Enabled shutdown Normal
8 Enabled shutdown Normal
9 Enabled shutdown Normal
10 Enabled Block Normal
11 Disabled shutdown Normal
12 Disabled shutdown Normal
DGS-3000-26TC:admin#
124
