ccna 8.1.4.7

ccna 8.1.4.7.6.3.3.4 BPDU FilteringThe BPDU filtering feature can be enabled globally on the switch or on a port-by-port basis. Depending on how it is enabled, it operates differently. At the global level, BPDU filtering can be enabled on interfaces that support PortFast using the spanning-treeportfastbpdufilterdefault global configuration mode command. This command prevents interfaces running in the PortFast state from sending or receiving BPDUs o Before the switch starts filtering outbound BPDUs, the interface still sends a small number of BPDUs when the link starts o Enable BPDU filtering globally on the switch so that hosts connected to these interfaces do not receive BPDUs o If a. interface connected to the switch (with PortFast enabled) receives BPDUs, the interface will lose its PortFast operational status and BPDU filtering will also be disabled.At the interface level, BPDU filtering can be enabled on any interface using the spanning-treebdufilterenable interface configuration command.and without enabling the PortFast feature. This command prevents the interface from sending or receiving BPDUs o Note: Enabling BPDU filtering on an interface causes a spanning tree loop as does disabling spanning tree on an interface. BPDU filtering is supported on PVST+, Fast PVST+, and MSTP. To display spanning tree status information, you can use the showspanning-tree summary command.6.3.3.5 Root ProtectionThe Cisco switch root protection feature provides a way to enforce the location of the root bridge in the network. Root protection places restrictions on the ports that participate in root bridge negotiation. If a port with root protection enabled receives a BPDU sent to it with a higher priority than the BPDU currently sent by the root bridge, the port enters the root inconsistent state, which is effectively equivalent to the STP listening state, and no data streams are forwarded from the port.Since the administrator can manually set the switch's bridge priority to 0, root protection seems unnecessary. However, setting a switch's priority to 0 does not ensure that the switch will be elected as the root bridge, because there may be another. The reason is that there may be another switch with a priority of 0 and a smaller MAC address, and therefore a smaller bridge ID.Root protection is best deployed towards the port connected to the switch and that switch should not be the root bridge. With root protection, if an attacking host sends a spoofed BPDU to become the root bridge, the switch, upon receiving the BPDU, will ignore the BPDU and force the port towill ignore the BPDU and force the port into a root inconsistent state. Once the spoofed BPDU stops being sent, the port will resume again.166 Chapter 6 Protecting the Local Area Network