cisco stp guard


STP guard


防止未許可的BPDU
重要性
 當"foreign or rogue" switch(未經授權的交換設備) is connected to the STP network
 該switch可能會變成root bridge,而造成未預期的stp拓樸,使網路發生變動
避免方法主要有以下兩種:
 Root Guard
 BPDU Guard

防止sudden loss of BPDUs
重要性:沒有BPDU可能會讓轉變port狀態時誤判,而形成LOOP
避免方法有以下兩種:
 LOOP GUARD
 UDLD

停止處理BPDU
方法為bpdu filtering

.............................

Root Guard
不允許designated port出現新的root bridge
If another switch advertises a superior BPDU, or one with a better bridge ID on "Root Guard port"
the local switch will 視為異常


發現異常時
當某個designated port發現switch變成root bridge,作業如下
1. the port that receive superior BPDU will be kept in the root-inconsistent STP state
2. No data can be sent or received in that state, but the switch can listen to BPDUs received on the port to detect a new root advertising itself

當發生異常時,log大致如下
%SPANTREE-2-ROOTGUARDBLOCK: Port 1/1 tried to become non-designated in VLAN 2. Moved to root-inconsistent state
ps:
Root Guard affects the entire port so that a root bridge never can be allowed on any VLAN on the port.
When a superior BPDU is heard on the port, the entire port, in effect, becomes blocked

恢復正常時
When the superior BPDUs no longer are received, the port is cycled through the normal STP states to return to normal use
ps:預設3個hello-timer周期(6秒)沒在收到則恢復

enable Root Guard
Switch(config-if)# spanning-tree guard root

by default, it is disabled on all switch ports
建議使用的介面:never expect to find the root bridge for a VLAN

display about root-inconsistent state
# show spanning-tree inconsistentports

Look for detailed reasons for inconsistencies.
# show spanning-tree interface < interface > [detail]


...................

bpdu Guard
防止portfast介面下收到bpdu

ps:
在portfast介面下一般都是接工作站,正常情況下不會收到任何bpdu


Suppose that a switch is connected by mistake to a port where PortFast is enabled.
可能的危害有以下
1. Now there is a potential for a bridging loop to form.
2. the newly connected device to advertise itself and become the new root bridge

發生異常時(bpdu guard介面收到bpdu時)
If any BPDU received on a port where BPDU Guard is enabled, that port immediately is put into the errdisable state
ps:
恢復正常時
bpdu guard介面不再收到bpdu時,the port still remains in the errdisable state


可隔離loop問題,但迴圈仍在
Naturally, BPDU Guard does not prevent a bridging loop from forming if an Ethernet hub
is connected to the PortFast port. This is because a hub doesn't transmit BPDUs itself
ps:
a loop can be detected only in a finite amount of time-the length of time required to move the port through the normal STP state

將所有portfast介面啟用bpdu Guard
Switch(config)# spanning-tree portfast bpduguard default

By default, BPDU Guard is disabled
建議在所有STP PortFast介面啟用
never should enable BPDU Guard on any switch uplink where the root bridge is located
ps:
enable bpdu Guard on a per-port basis
Switch(config-if)# [no] spanning-tree bpduguard enable

Display the global BPDU Guard status
# show spanning-tree summary [total]

...............................


Loop Guard
keeps track of the BPDU activity on nondesignated ports(避免Bloack Port成為Forwarding status而導致Loop)
只運作在nondesignated role(root port,block port)

當blocking port沒收到bpdu一直到maxage timer後,會認為沒有連接到stp設備,因此就會離開blocking status,並根據stp規則會轉變為forwarding status
當連接設備為
 開機的pc:可正常傳送流量 
 未傳送bpdu之switch:可傳輸流量因此形成loop

發生異常時(BPDUs go missing and link is up)
Loop Guard moves the port into the loop-inconsistent state
The port is effectively blocking at this point to prevent a loop from forming and to keep it in the nondesignated role
ps: blocking action is taken on a per-VLAN basis ,so Loop Guard doesn't block the entire port

恢復正常時(BPDUs are received on the port again and link is up)
Loop Guard allows the port to move through the normal STP states and become active

enable Loop Guard as a global default
Switch(config)# spanning-tree loopguard default

ps:
enable Loop Guard on a specific switch port
Switch(config-if)# [no] spanning-tree guard loop

By default, Loop Guard is disabled
ps:
(config-if)#switch mode trunk不會干擾loop guard
ps:
Access ports不會收到BPDUs,若LoopGuard設在access ports,則會一直保持Loop Inconsistent mode並block the port

Display the Loop Guard states.
# show spanning-tree summary

.........................................


UDLD(Unidirectional Link Detection)
interactively monitors a port to see whether the link is truly bidirectional
ps:It is recommended that it be used with the "loop guard" feature

unidirectional link問題
if just one side of the link (receive or transmit) had an odd failure, such as malfunctioning transmit circuitry in a GBIC or SFP modules?
In some cases, the two switches still might see a functional bidirectional link, although traffic actually would be delivered in only one direction. This is known as a unidirectional link
ex:switch1可把packet傳給neighbor switch2,但switch2傳的packet無法被switch1收到 
ps:
Twisted-pair or copper media does not suffer from the physical layer conditions that allow a unidirectional link to form
ps:
此情況發生時,在兩邊使用show cdp會發現,只有一邊看的到對方

 

unidirectional link的危險
A unidirectional link poses a potential danger to STP topologies because BPDUs will not be received on one end of the link. If that end of the link normally would be in the Blocking state, it will not be that way for long. A switch interprets the absence of BPDUs to mean that the port can be moved safely through the STP states so that traffic can be forwarded.
However, if that is done on a unidirectional link, a bridging loop forms and the switch never realizes the mistake

UDLD運作原理
1
A switch sends special Layer 2 UDLD frames identifying its switch port at regular intervals(The default is 15 sec)
Destination MAC為0100:0CCC:CCCC
2
UDLD expects the far-end switch to echo those frames back across the same link, with the far-end switch port's identification added
3
正常情況下
If a UDLD frame is received in return and both neighboring ports are identified in the frame, the link must be bidirectional

異常發生時
if the echoed frames are not seen, the link must be unidirectional for some reason
UDLD根據不同mode有不同做法
Normal mode :
the port is allowed to continue its operation.

UDLD merely marks the port as having an undetermined state and generates a syslog message
aggressive mode(recommended)
the switch takes action to reestablish the link.
UDLD messages are sent out once a second for 8 seconds.
If none of those messages is echoed back, the port is placed in the Errdisable state so that it cannot be used

UDLD時間
需在blocked port into the Forwarding state之前檢測到unidirectional link condition
ps:
the target time must < "the Max Age timer + two intervals of the Forward Delay timer", ( default is 50 seconds)
檢測unidirectional link時間不超過 3 times the UDLD message interval (default 45sec total).

UDLD啟用過程
1
UDLD has no record of any neighbor on the link.
It starts sending out messages,
2
case1:the neighboring switch also support UDLD
a neighboring switch will hear them and echo them back
case2:the neighboring switch does not yet have UDLD enabled
UDLD will
 1. keep trying (indefinitely) to detect a neighbor
 2. not disable the link
After the neighbor has UDLD configured also,
a neighboring switch will hear them and echo them back
3
both switches become aware of each other and the bidirectional state of the link through their UDLD message exchanges
if messages are not echoed, the link can accurately be labeled as unidirectional
ps:
This becomes important in an EtherChannel:
If one link within the channel becomes unidirectional, UDLD flags or disables only the offending link in the bundle,not the entire EtherChannel. UDLD sends and echoes its messages on each link within an EtherChannel channel independently


以global設定udld作業模式
(config)# udld < enable | aggressive>
By default,UDLD is disabled on all switch ports
enables UDLD only on ports that use fiber-optic media
各參數說明如下
enable: 預設,使用normal mode
aggressive: 使用aggressive mode
ps:
以port設定udld作業模式
(config-if)# udld < enable | aggressive | disable>
disable是關閉這個port的udld
ps:
建議以global啟動方式代替individual port啟動
ps:
UDLD注意事項
an echo process such as this requires both ends of the link to be configured for UDLD . Otherwise, one end of the link will not echo the frames back to the originator

設定udld time intervals
(config)# udld message time < seconds>
seconds可設範圍為7-90秒
ps:Catalyst 3550 default is 7 sec; Catalyst 4500/6500 default is 15 seconds


Display the UDLD status on one or all ports.
# show udld < interface>

Reenable ports that UDLD aggressive mode has errdisabled.
# udld reset

...............................

BPDU Filtering
to prevent BPDUs from being sent or processed on one or more switch ports
disable STP on those ports
ps
Enable BPDU filtering only if the connected device cannot allow BPDUs to be accepted or sent. Otherwise, you should permit STP to operate on the switch ports as a precaution.

 

將所有portfast介面啟用bpdu filtering
(config)# spanning-tree portfast bpdufilter < default | enable >

default:當portfast介面收到bpdu時,該介面portfast會被關閉並enable stp  
If PortFast is disabled on a port, then BPDU filtering will not be enabled there
By default, BPDU filtering is disabled on all switch ports
ps:
you are absolutely sure that a switch port will have a single host connected and that a loop will be impossible
ps:
enable(or disable) bpdu filtering on a per-port basis
(config-if)# spanning-tree bpdufilter < enable | disable>

Display the BPDU filter states
# show spanning-tree summary [ total]

2011-09-13 20:16:10發表 0000-00-00 00:00:00修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows
unix-like
linux service
network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識
資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3
Cisco layer2




  登入      [牛的大腦] | [單字我朋友] Powered by systw.net