How to distinguish BPDU filter and BPDU protection？

Popeye_Wang · Created Apr 23, 2019 11:39:16

Hi there!

On a network running a Spanning Tree Protocol, if a port connected to terminals is configured as an edged-port, the portwill not participate in the Spanning Tree calculation. This speeds up the network convergence and improves network stability.

However, this port will still send BPDUs. And it will lose its edge port attributes after receiving BPDUs. The BPDUfilter and BPDU protection are used to address this two problems, respectively.

Here is a simple comparison:

	BPDU filter	BPDU protection
command	system or interface view: stp bpdu-filter enable	system view: stp bpdu-protection
function	edge port that receives BPDUs will enter the Error-Down	edge port will Not send BPDUs

Popeye_Wang · Created Apr 23, 2019 11:39:16

Hi there!

On a network running a Spanning Tree Protocol, if a port connected to terminals is configured as an edged-port, the portwill not participate in the Spanning Tree calculation. This speeds up the network convergence and improves network stability.

However, this port will still send BPDUs. And it will lose its edge port attributes after receiving BPDUs. The BPDUfilter and BPDU protection are used to address this two problems, respectively.

Here is a simple comparison:

	BPDU filter	BPDU protection
command	system or interface view: stp bpdu-filter enable	system view: stp bpdu-protection
function	edge port that receives BPDUs will enter the Error-Down	edge port will Not send BPDUs

Hamid_84102332 · Created Apr 23, 2019 11:39:23

BPDU FILTER
============
As defined in RSTP, a port that is located at the edge of a network and directly connected to a terminal device is an edge port.

Edge ports can still send BPDUs. If the BPDUs are sent to another network, this network may encounter network flapping. To prevent this problem, configure the BPDU filter function on edge ports so that the edge ports do not process or send BPDUs.
check below link
https://support.huawei.com/hedex/pages/EDOC1100037168AEI0129V/07/EDOC1100037168AEI0129V/07/resources/dc/dc_cfg_stp_0023.html?ft=0&fe=10&hib=10.3.4.14.9.8&id=dc_cfg_stp_0023&text=Configuring%20Edge%20Ports%20and%20BPDU%20Filter%20Ports&docid=EDOC1100037168

BPDU protection
=========
Edge ports are directly connected to user terminals and, in most cases, will not receive BPDUs. However, attackers may send pseudo BPDUs to attack the switch with edge ports. In this case, if the edge ports receive the BPDUs, they are then configured as non-edge ports and spanning tree recalculation is triggered. Network flapping then occurs. Such attacks can be mitigated using BPDU protection on switches with edge ports. After BPDU protection is enabled on the switch, the switch shuts down an edge port if the edge port receives a BPDU.

check below link
https://support.huawei.com/hedex/pages/EDOC1100037168AEI0129V/07/EDOC1100037168AEI0129V/07/resources/dc/dc_cfg_vbst_0029.html?ft=0&fe=10&hib=10.3.4.16.9.1&id=dc_cfg_vbst_0029&text=Configuring%20BPDU%20Protection%20on%20the%20Switch&docid=EDOC1100037168

Sprout · Created Apr 24, 2019 00:51:08

Thank you very much @all

How to distinguish BPDU filter and BPDU protection？

Third Party’s Trade Secret

`@trans`bright_future`~trans`

Enterprise

Consumer

Corporate

Carriers

How to distinguish BPDU filter and BPDU protection？

Third Party’s Trade Secret

`@trans`bright_future`~trans`