SpanGuard feature on Enterasys Products

FAQ_User — Thu, 05 Sep 2013 06:03:00 GMT

Article ID: 5258

Products
DFE
Matrix C1
Matrix E1
SecureStack A2
SecureStack B2
SecureStack C2
SmartSwitch 2000 2nd Generation
SmartSwitch 6000 2nd Generation
SmartSwitch 6000 3rd Generation

Protocols/Features
SpanGuard
Spanning Tree

Goals
What is SpanGuard
Which products support SpanGuard

Solution
SpanGuard (originally known as Secure Span) is a feature which shuts down a network port if it receives a BPDU. This feature may be activated on network edge ports, for the purpose of preventing "rogue" STA-aware devices from disrupting the existing Spanning Tree.

When SpanGuard is enabled (this is a global option, disabled by default), reception of a BPDU (except loopback) by a port which has the STA adminEdge option enabled will cause the port to be locked and its state set to Blocking. By default, this condition will last for five minutes after reception of the last BPDU.

Enterasys devices which support this feature:

Matrix N-Series DFE, firmware 4.00.50 and higher
Matrix C1, firmware 2.00.14 and higher
Matrix E1, firmware 3.00.14 and higher
SecureStack A2, firmware 1.03.17 and higher
SecureStack B2, firmware 3.01.16 and higher
SecureStack C2, firmware 4.00.24 and higher
SmartSwitch 2000/6000 2nd/3rd Generation, firmware 5.06.04 and higher

For the DFE, C1, and E1 (see 5756 for the SecureStack defaults); adminEdge is disabled (i.e. "adminedge false") by default, and must be enabled for individual User ports. If this is not done, SpanGuard will not function when enabled.
For the other products, adminEdge is enabled by default (i.e. "adminedge true"), and must be disabled for individual Uplink ports. If this is not done, SpanGuard will block uplink ports when enabled, as BPDUs are received.

After adjusting adminEdge and enabling SpanGuard ('set spantree spanguard enable'), it is highly recommended to review the status of your ports ('show spantree spanguardlock *.*.*'). The resulting display should show all ports as unlocked. Otherwise, either an uplink port has been set as "adminEdge true" in error, or a BPDU-ingressing edge port warrants further investigation.

Self-loopback-protection is already being handled as a separate function, possibly as a result of the action of 802.1w. The reception of foreign, unexpected BPDUs from beyond the edge of the defined Spanning Tree is truly a different issue, and is addressed by the SpanGuard feature.

topic SpanGuard feature on Enterasys Products in FAQs

SpanGuard feature on Enterasys Products