Layer 2 Security - STP configuration

Preventing broadcast storms

Layer 2 VLAN Security

To make switch dynamically assign it priority lower than best one advertised in received BPDUs from all other switches in the segment:

Central(config)# spanning-tree vlan 1 root primary

BPDU Guard shuts down a port that receives a BPDU. When configured globally, BPDU Guard is only effective on ports in the operational PortFast state. When configured at the interface level, BPDU Guard shuts the port down as soon as the port receives a BPDU, regardless of the PortFast configuration.

SW-B(config-if-range)# spanning-tree bpduguard enable

BPDU Guard can also be applied not only in interface, but also in "Switch(config)#" global configuration mode. When enabled globally, BPDU Guard applies to all interfaces that are in an operational PortFast state.

Switch(config)#spanning-tree portfast bpduguard default

The STP Root Guard feature prevents a port from becoming root port or blocked port. If a port configured for root guard receives a superior BPDU, the port immediately goes to the root-inconsistent (blocked) state - thus Root Guard feature prevents surrounding switches from announcing themselves as Root Bridges.
When configured on a port, this feature forces that port to remain as designated port and prevent it from becoming a root port. If another switch announces a superior (lower) BPDU on a port where root guard is enabled, the local switch will not allow the new switch to become the root.

SW-1(config)# interface fa0/23 SW-1(config-if)# spanning-tree guard root Switch(config-if)#%SPANTREE-2-ROOTGUARDBLOCK: Port 0/2 tried to become non-designated in VLAN 1.

Storm-control broadcast level 10 command limits that interface to only transmit at most 10% of its interface bandwidth worth of broadcast packets - if we have a 10-Mbps Ethernet line connected, we allow up to 1 Mbps of broadcasts every second before suppressing anything. 0.0 percent suppresses all traffic.

Switch(config-if)#storm-control ? broadcast Broadcast address storm control Switch(config-if)#storm-control broadcast ? level Set storm suppression level on this interface Switch(config-if)#storm-control broadcast level ? <0.0-100.0> Enter rising threshold Switch(config-if)#storm-control broadcast level 10

Layer 2 VLAN Security

to disable DTP on this port use nonegotiate. Switchport type must be manually set as access or trunk

SW-2(config)# interface fa0/23 SW-2(config-if)# no shutdown SW-2(config-if)# switchport mode trunk SW-2(config-if)# switchport trunk native vlan 15 SW-2(config-if)# switchport nonegotiate

instead of vlan 1, we can assign ip address to another vlan and shut down vlan 1 if management vlan was there. Other switches in segment also have IP addreses from that range

SW-A(config)# interface vlan 20 SW-A(config-if)# ip address

to acess this vlan, a subinterface is needed

R1(config)# interface fa0/0.3 R1(config-subif)# encapsulation dot1q 20 R1(config-subif)# ip address