cancel
Showing results forĀ 
Search instead forĀ 
Did you mean:Ā 

Are there any easy ways to configure edge-safeguard mode with bpdu-restrict?

Are there any easy ways to configure edge-safeguard mode with bpdu-restrict?

Ilya_Semenov
Contributor

Hello, everybody!

I have a task from a customer to config ports on Extreme stack to prevent users from attaching switches and turn ports in forwarding mode immediately (dot1w).

So, does anybody know more easliy way to get CISCO's "spanning-tree bpduguard enable" analog on Extremes, than described here - https://extremeportal.force.com/ExtrArticleDetail?an=000082693
I did these thing like in the article many times, but it is too difficult in this case because there are 8-slot stack where many vlans exist and vlans ports don't go in a row like VLAN10 port 1:1-48, but VLAN10 ports 1:1-4,1:6-10,1:18-21 etc.

Many thanks in advance,

Ilya

6 REPLIES 6

Erik_Auerswald
Contributor II
Hi Ilya,

the exact functionality of Cisco IOS' "spanning-tree bpduguard enable" requires some spanning tree protocol on the port. Thus on EXOS you need to configure and stpd that includes the access port to exaclty recreate the BPDUguard functionality.

You may be able to create similar functionality using ELRP to guard against loops, and perhaps something based on ACLs, log entries, and scripts triggered by logs to react to a BPDU.

Erik

Ilya_Semenov
Contributor
Anybody?

Am I understand right, that without STPD configuration on access-ports I can't get CISCO's "spanning-tree bpduguard enable" analogous functionality on Extremes?

Zdeněk_Pala
Extreme Employee
I am using following config. I believe it is quite simple and does what you need:
configure mstp region region1
configure stpd s0 mode mstp cist
configure stpd s0 priority 4096# the above usualy complain that vlan default is already autobinded => "disable stpd s0 auto-bind vlan default" try it again and then auto-bind it again
enable stpd s0 auto-bind vlan VLAN-X
enable stpd s0 auto-bind vlan VLAN-Y ...# you need to add every vlan to the s0
configure stpd s0 ports link-type edge 1:1-48
configure stpd s0 ports edge-safeguard enable 1:1-48 recovery-timeout 60
configure stpd s0 ports bpdu-restrict enable 1:1-48 recovery-timeout 60 ...# the above will do the job for ports 1-48 on the unit 1. Be sure you do not configure it on your uplink šŸ™‚
enable stpd s0probably there is also some more nice way...

Good luck

Regards Zdeněk Pala

Hello, Zdenek!

Many thanks for your reply.

In what version of EXOS auto-bind does work for untagged ports? Enlight me, please.

I believe that ezSpanningtree is a great application, but it requires EXOS 21.x. All my switches are G1, so I can't use it anyway.

MSTP is not recommended STP protol for Summit. You can use search in this community to easily find out how tricky, dangerous and unstable Extreme's MSTP is. There are a lot of topics and related articles.

So, may be auto-bind works for untag in MSTP, but in PVS+ it doesn't. (Like bpdu-restrict, unfortunately)

GTM-P2G8KFN