topic Re: Can turn off the BPDU Guard and BPDU Filter ? in HPE Aruba Networking & ProVision-based

Can turn off the BPDU Guard and BPDU Filter ?

David_Look — Fri, 03 Jan 2014 07:46:54 GMT

What is the BPDU Guard and BPDU Filter?

If turn off the BPDU Guard and BPDU Filter, what will effect?

Re: Can turn off the BPDU Guard and BPDU Filter ?

Richard Brodie_1 — Fri, 03 Jan 2014 13:14:32 GMT

BPDU (bridge protocol data unit) is standards speak for spanning tree packet.

BPDU guard protects against unauthorized switches (including software implementations) from making changes to your spanning tree topology. You can very easily DoS a network this way, and there is no authentication mechanism that I know of. It disables the port on receiving a spanning tree message.

BPDU filter just discards spanning tree packets on arrival, and also stops them being sent. It's effectively disabling spanning tree on the port. It's slightly more risky than BPDU guard, because if you use it too liberally you run the risk of creating loops.

Re: Can turn off the BPDU Guard and BPDU Filter ?

David_Look — Sat, 04 Jan 2014 02:20:25 GMT

Dear Richard Brodie 1, thanks you for the explanation.

Our Switch have assigned the vlan for IPTV and AP.

We have a case of when the IPTV undated firmware from their server,

our switch were not detect from their date. Our switch configuration like below.

spanning-tree
spanning-tree 2 admin-edge-port
no spanning-tree 2 auto-edge-port
spanning-tree 2 root-guard bpdu-filter bpdu-protection
spanning-tree 4 admin-edge-port
no spanning-tree 4 auto-edge-port
spanning-tree 4 root-guard bpdu-filter bpdu-protection

If turn off/disable bpdu, it will have any side effect?

Re: Can turn off the BPDU Guard and BPDU Filter ?

Richard Brodie_1 — Sat, 04 Jan 2014 09:54:05 GMT

"If turn off/disable bpdu, it will have any side effect?"

It's unlikely. Worst case the spanning tree configuration change ripples through your network and you see some brief disruption. It only tends to be really bad if it starts flapping around (dodgy connection, reboot cycle, etc.)

Have you looked in the switch log? If BPDU protect disables the port, it should log it. Otherwise, I wonder if it might be a red herring.